text: The Company has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our tenants, managers or business partners will be successful in preventing a cybersecurity incident, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our tenants, managers or business partners, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. For example, in November 2023, Ardent became aware of a cybersecurity incident, which Ardent determined to be a ransomware attack and which resulted in disruptions to certain aspects of Ardent's clinical and financial operations. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—The occurrence of cybersecurity incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of confidential or personal information or damage our or their business relationships and reputation. included in Part I, Item 1A of this Annual Report.

companyName: Ventas, Inc.

ticker: VTR


text: We have implemented a third-party risk management program to proactively identify and mitigate any potential risks that emerge from our supplier and partner ecosystem. There are processes in place to restrict and provide need-based access to sensitive or confidential data for third parties. We conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.

companyName: ExlService Holdings, Inc.

ticker: EXLS

secItem: Item 1C


text: Our CIDO is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Director of Information Security and Compliance.

companyName: ROGERS CORP

ticker: ROG


text: Our management teams, including the ISC, our CIO, Vice President of Infrastructure Services, and others within our Information Technology department, as appropriate, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event that the Company experiences a cybersecurity incident it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Our ERC, comprised of our CLO, our CDO, our CISO, our Vice President of Internal Audit, and our Vice President of Ethics, Compliance and Risk Management, among others, oversees our ERM activities, including cybersecurity-related risks. Our CDO and our CISO (who reports to our CDO) are primarily responsible for the assessment and management of our material risks from cybersecurity threats, working collaboratively and cross-functionally to design and implement our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, and for responding to any cybersecurity incidents. In addition, our CITF (which includes our CDO, our CISO, our CLO, and our Chief Financial Officer ("CFO")) is primarily responsible for evaluating cybersecurity incidents, gathering and assessing facts relevant to applicable regulatory reporting and disclosure obligations, making recommendations to our Chief Executive Officer and CFO regarding such disclosure, and advising our board of directors and audit committee on the effectiveness of policies and procedures related to the disclosure of cybersecurity incidents.

companyName: TWILIO INC

ticker: TWLO


text: Our cybersecurity leadership team brings extensive qualifications and expertise: • Our CISO has over 15 years of experience in information security, including leadership roles at Nissan Motors and Ingram Micro. He has performed investigations in the public sector as a deputized high-tech crimes investigator with a digital forensic certification. He serves on numerous cyber industry organization boards and lends his expertise as a leader and practitioner. He speaks at numerous events annually on various cyber topics. • Members of the broader security team maintain various professional certifications including CISSP, CISM, CEH, and SANS certifications. We maintain partnerships with leading universities to support continuing education and stay current with emerging threats and technologies.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: The Company believes that by layering cybersecurity practices and risk management oversight in a way that involves various individuals, teams, and ultimately, the Board of Directors, it fosters a culture of accountability and helps enable Cass to prioritize the safety and security of its and its clients' data.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The audit committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short, intermediate, and long-term timeframe. Audit committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the chief financial officer on our enterprise risk profile on an annual basis. The audit committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Semler Scientific, Inc.


text: See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: Investview, Inc.

ticker: INVU


text: In the fiscal year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Risks Related to Our Business—We rely significantly on technology and systems to support our production, supply chain, payments, financial reporting and other key aspects of our business. Any failure, inadequacy, interruption or security failure of those systems could have a material adverse effect on our business, reputation and brand, financial condition, and results of operations" and "Risks Related to Our Business—System security risk issues, and disruption of our internal operations or information technology systems, could have a material adverse effect on our business, financial condition, and results of operations" in Item 1A-Risk Factors.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Management also plays a crucial role in assessing and managing Bancorp's cybersecurity risks. Specific roles, such as the Information Security Officer (ISO) and Director of Information Security (DIS), are tasked with monitoring, evaluating, and mitigating these risks in coordination with the ISSG. Both the ISO and DIS possess relevant expertise and experience in cybersecurity, enabling them to effectively navigate and respond to emerging threats. The ISO, who holds a Bachelor's degree in Computer Science and a Master's degree in Information Systems Security, along with several relevant industry certifications, has been with Bancorp for three years and has additional experience working in technology outside of the organization. The DIS, who also holds several relevant certifications, has been with Bancorp's Information Security department for 19 years and brings extensive experience with technology.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: The Company's business is highly dependent on the communications and information systems of the Adviser, its affiliates and third-party service providers. The Adviser is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with the Adviser and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations. These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning, and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the team's response readiness capabilities.

companyName: TPG Twin Brook Capital Income Fund


text: The Information Security Department reports to the Chief Information Security Officer and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity efforts and recommendations are reported to the Risk Management Council no less than quarterly which is then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks. As noted, we employ a Chief Risk Officer, along with information security personnel in our Information Security Department. The Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership. See "Risk Management" in section of MD&A for an overview of our risk management framework.

companyName: FNB CORP/PA/

ticker: FNB


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the Risk Committee of the Board of Directors. The Risk Committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The Risk Committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. Our CTO reports regularly to the Risk Committee on cybersecurity and information security and the full Board reviews significant cybersecurity matters as appropriate.

companyName: NCR Voyix Corp

ticker: VYX


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments, establish an incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of this report, we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors. Our Vice President of Finance and Administration has been designated as the lead for implanting our incident response plan. In addition, in 2024, we have acquired a cybersecurity insurance policy.

companyName: EON Resources Inc.

ticker: EONR


text: We incorporate assessment of our cybersecurity initiatives into our Enterprise Risk Management program. The Enterprise Risk Management program evaluates risk areas including, but not limited to, operational risk, intellectual property theft, fraud, harm to employees, patients, or third parties, and violation of privacy or security-related laws or regulations. As part of our efforts to mitigate cyber risk, we have implemented cybersecurity processes, technologies, and controls designed to identify and manage potential material cyber risks and have obtained cyber-specific insurance coverage.

companyName: INSMED Inc

ticker: INSM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and infrastructure. This program includes the implementation of a set of system, network and application level controls to protect our data and systems. These controls are monitored for cybersecurity risks and incidents by internal staff and our third-party service provider and are updated as necessary to protect the Company.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: Our CISO has over 25 years of information security experience during which he has worked on various information technology and security programs, including privacy operations and security risk management. He has experience with many different types of enterprises, including the federal government, private companies, and publicly listed companies. Our CISO was also a founding member of the U.S. Department of Homeland Security and is a veteran who served in the United States Marine Corps. Our CISO has a Bachelor of Science in Information Technology and an MBA.

companyName: TERADATA CORP /DE/

ticker: TDC


text: The cybersecurity sub-committee plays a pivotal role in informing the risk management committee on cybersecurity risks. They provide comprehensive briefings to the risk management committee on a regular basis. These briefings encompass a broad range of topics, including: • Awareness of cybersecurity landscape, emerging threats, trends and developments; • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Compliance with regulatory requirements and industry standards; and • Education in cybersecurity and associated risk management frameworks.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Management's Role Managing Risk The CIO plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the CIO on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the CIO and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Eradication —remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: We seek to enhance our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. For example, we conduct regular risk assessments at planned intervals for high priority systems and/or applications to identify and analyze threats and vulnerabilities, identify controls, identify risk ratings and likelihood and level of potential impact, and provide recommendations for risk reduction, mitigation, acceptance, and avoidance. As part of our overall risk mitigation strategy, we also maintain cyber liability insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: TechTarget Holdings Inc.


text: The Company's Information Security Working Group ("ISWG") is actively engaged in managing cybersecurity risks and overseeing the design, implementation, and evaluation of the Program. The purpose of the ISWG is to define cybersecurity risk tolerance, guide implementation of the Program, monitor Program development and effectiveness, and validate investments in cybersecurity measures and infrastructure. Members of the ISWG include: the Chief Financial Officer, the head of the Company's Human Resource department, the Senior Vice President of Program Management, Corporate Infrastructure, and Clinical Operations, the Senior Vice President of Regulatory and Quality Assurance, and the Company's head of Information Technology. The group meets quarterly to review the effectiveness of the Program, discuss any new developments and potential improvements to the Program, and evaluate internal and external security-related events to determine how Avalo can take appropriate steps to mitigate such risks.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: Our Chief Information Security Officer and our Security Team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include the following: regular penetration testing, independent third-party risk and security posture assessments, phishing tests (with trainings for the failed users), general cybersecurity and phishing training for all Rambus personnel and tabletop exercises to simulate threats and identify gaps.

companyName: RAMBUS INC

ticker: RMBS


text: Cybersecurity Program Overview AGL Private Credit Income Fund has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of AGL US DL Management LLC (the "Adviser") and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: AGL Private Credit Income Fund


text: While we believe we have implemented appropriate measures and controls for our business, there can of course be no assurance that cyber incidents will be prevented or of their severity if they occur. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation and brand and our future sales and could expose us to potential liability. See Item 1A. Risk Factors - A cyber security incident or other technology disruption could harm us.

companyName: Omega Flex, Inc.

ticker: OFLX


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO. We also have an enterprise Artificial Intelligence Governance and Oversight Committee focusing on the use and management of AI in our operations.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. We have a set of Company-wide policies and procedures outlined in our Employee Handbook that directly or indirectly relate to cybersecurity risks. These policies go through an internal review process and are approved by appropriate members of management.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: Arrow's Board of Directors, Chief Information Officer, Director of IT and our enterprise risk management group all have a role in the cybersecurity risk management program.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: The VP, Chief Privacy Officer, dedicated Cyber Security Analyst, and other key members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures, and provide for continuity of operations.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Cybersecurity is an area of increasing concern to management and our investors. By design, our device and software (LuViva) are not connected to the internet. Patient results cannot be saved to the device and must first be downloaded to a flash drive and then transferred to another computer or cloud-based system to be saved. The design of our product limits our exposure to the compliance requirements of NIST 800 - 171. Our Company generally keeps all employee personally identifiable information with our payroll service provider. Each year the provider furnishes us with their SOC report which includes their cybersecurity policies and procedures.

companyName: GUIDED THERAPEUTICS INC

ticker: GTHP


text: Our cybersecurity program is designed to align with industry's best practices, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Key elements include: Regular risk assessments and vulnerability scans across our network and cloud environments. Formal policies covering access control, data protection, encryption, system configuration and change management. Tiered security controls (e.g., firewalls, endpoint protection, multi-factor authentication) to guard against unauthorized access.

companyName: ALEXANDER TECH CORP


text: We conduct regular training for cybersecurity awareness of our employees, senior executives, and certain other vendors or personnel. We also perform phishing and social engineering simulations and provide cybersecurity training for personnel with Company email and access to Company assets. We disseminate security awareness communications to certain employees to highlight emerging or urgent cybersecurity threats.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board's Audit and Risk Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the entire Board receives an overview from management of our cybersecurity program and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board discusses such matters with our Chief Risk Officer (CRO) and Chief Information Security Officer (CISO). Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Bakkt, Inc.

ticker: BKKT


text: The Company will designate a Chief Information Security Officer (the "CISO"). The Program will be implemented and managed by the Company's executive management under the leadership of the CISO.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: In addition to the safeguards in place to minimize the likelihood and impact of a cyber incident, the Company has established response procedures to address in the event they may occur. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents in a timely, consistent, and compliant manner. Annually, the Company completes incident response, disaster response, and crisis management plan exercises to validate our current readiness. These exercises are intended to test our cybersecurity response plans and resources through simulated cybersecurity incidents, and may include engagement of outside cybersecurity legal counsel, other third-party partners, executive management, and our Board of Directors.

companyName: ONE Gas, Inc.

ticker: OGS


text: Management and Strategy regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our process. Our cybersecurity risk assessment is part of our overall risk management program. We also regularly engage outside consultants to assess, identify and manage material risks from cybersecurity threats, including those threats associated with our use of third-party service providers. These consultants recommend, implement and monitor systems to protect against cybersecurity threats.

companyName: IMMUCELL CORP /DE/

ticker: ICCC


text: While we are subject to continuous cybersecurity threats and attacks like most companies, we are not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors," cybersecurity threats are continually evolving to become more sophisticated and there is a risk that we could experience compromise of our information technology systems and data. Accordingly, while we continue to make significant investment in physical and technological security measures, including third-party services designed to help us anticipate cyber-attacks and prevent breaches, we cannot provide assurance that we will be successful in adequately responding to, or preventing, cyber-attacks. We also maintain cybersecurity insurance that is regularly reviewed to assess whether there is appropriate coverage.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: We have implemented and maintain a formal information security management program designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, services, and data. Our information security management program includes a dedicated security team led by our Head of Security that is responsible for implementing security controls and monitoring for suspicious activity. Our information security management program also includes a cybersecurity risk management process which aims to identify and assess material risks from cybersecurity threats, including from vulnerabilities within Asana systems and new and emerging threats to Company operations by using automated and manual tools, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, and conducting audits and threat assessments.

companyName: Asana, Inc.

ticker: ASAN


text: In the event a cybersecurity incident is identified, our Cybersecurity Incident Response team will act in accordance with our incident management plans to communicate to our executive leadership team and to coordinate the response to any incident. Our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Technology and Digital Officer, CISO and Chief Compliance Officer are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event. We maintain cybersecurity insurance coverage that insures us for costs resulting from cyberattacks, although this coverage may not reimburse us for all losses.

companyName: DELUXE CORP

ticker: DLX


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced and will likely experience threats and security incidents that could affect our information or systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.

companyName: Phreesia, Inc.

ticker: PHR


text: Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. We maintain a cybersecurity risk management program designed to identify, assess, and manage material risks from cybersecurity threats to our information systems and the digital assets and data we handle. Our program includes periodic risk assessments, control implementation, testing, and incident response processes, and it is integrated with our broader enterprise risk management framework.

companyName: BITMINE IMMERSION TECHNOLOGIES, INC.

ticker: BMNR


text: In the ordinary course of our business, we receive, process, retain, transmit and store proprietary information and sensitive or confidential data, including certain public and nonpublic personal information concerning employees and borrowers. In addition, we enter into relationships with third-party vendors to assist with various aspects of our business, some of which require the exchange of personal employee or borrower information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems, including those pertaining to third-party service providers, that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by dedicated information security teams, including technology risk, cybersecurity operations, cybersecurity engineering, and identity and access management, led by our Chief Information Security Officer ("CISO"). These teams collectively manage and monitor mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, access, or other security incidents or vulnerabilities affecting our data, digital assets and systems in furtherance of maintaining a secure information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct regular employee training on cyber and information security topics, phishing and simulations. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. We also utilize a third party for cybersecurity incident monitoring and response.

companyName: loanDepot, Inc.

ticker: LDI


text: We have an enterprise-wide information security program designed to protect our information systems from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our digital assets and our risk profile using various methods. We monitor security events that are internally discovered or externally reported that may affect our systems and have processes and procedures to assess those events for potential cybersecurity impact or risk and consequently improve our security measures and planning. Additionally, we work with third parties from time to time that assist us in refining our cybersecurity risk strategy in order to identify, assess and manage cybersecurity risks, including professional services firms and consulting firms. We seek to detect and investigate unauthorized attempts and attacks against our network and services, and to minimize their occurrence and recurrence through changes or updates to our internal processes and tools and changes or updates to our services; however, we remain potentially vulnerable to known or unknown threats.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: We use third-party security firms to provide or operate certain controls and technology systems. We use third parties to conduct assessments, such as monitoring vulnerability scans and penetration testing. We address cybersecurity threats related to our third-party technology and services through several processes, including pre-acquisition due diligence, contractual obligations and performance monitoring.

companyName: NuStar Energy L.P.


text: Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.

companyName: Greenwich LifeSciences, Inc.

ticker: GLSI


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Marpai, Inc.

ticker: MRAI


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats in order to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use and storage of data.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Our Chief Information Officer ("CIO") is responsible for delivering on the Company's global Information Technology ("IT") strategy, including infrastructure, data and analytics, application delivery, end user services, cybersecurity risk management and the digital technology transformation program. The IT leadership team leads the implementation of the IT strategy and the day-to-day operations. Under the guidance of the CIO, our Chief Information Security Officer ("CISO") leads Information Security ("InfoSec"), which includes the Cyber Fusion Center, Infrastructure Security, including network segmentation, firewalls and intrusion detection and prevention systems, Identity and Access Management, Application Security, Data Security and InfoSec Governance, Risk and Compliance. InfoSec is overseen by the InfoSec Steering Committee, comprised of senior leaders representing all corporate functions and business units, and the InfoSec Governance Review Board, comprised of the IT leadership team and the InfoSec leadership team. InfoSec is governed in coordination with IFF's ERM Committee and is aligned to the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition to our dedicated leadership team overseeing InfoSec, we view InfoSec as a shared responsibility, and to best protect our network, computers and data from threats, we empower our employees to be our first line of defense. To that end, all employees globally complete annual mandatory InfoSec training on email security, password security and our Acceptable Use Policy. We use email security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing emails and avoid IT system interruptions.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: PGE considers cybersecurity to be a top enterprise risk and manages the risk by following established practices for assessment, protection, response, and oversight. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company's future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—"Risk Factors." The Company has not experienced a material cybersecurity incident.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: We view cybersecurity as a shared responsibility of the Audit Committee and the IT team led by the Director of Information Technology, and we incorporate external resources and advisors as needed to conduct evaluations of our security controls through penetration testing, independent audits and consulting on best practices. The results of those tests are presented annually to the Board.

companyName: ENNIS, INC.

ticker: EBF


text: Currently, Jack Wang senior advisor of our subsidiary PeriShip Global, has primary responsibility for managing material cybersecurity risks. Mr. Wang holds an undergraduate and master's degree in computer science and has served in various roles in information technology and security for over 20 years. Mr. Wang is responsible for reporting any cybersecurity related incidents to our executive officers. Our executive officers are responsible for reporting material cybersecurity related incidents to our Board of Directors. We may implement other reporting structures governing the day-to-day management and reporting of cybersecurity risks.

companyName: VerifyMe, Inc.

ticker: VRME


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical studies, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management (ERM) process. As part of our ERM process, cross-functional leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Additionally, we undertake the following activities as part of our processes to assess, identify and manage material risks from cybersecurity threats: • monitor emerging data protection laws and implement changes to our processes as needed; • conduct periodic cybersecurity management and incident training as well as social engineering training for employees and consultants involved in our systems and processes that handle sensitive data; • require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • perform tabletop exercises to simulate a response to a cybersecurity incident and use the findings to inform our processes and technologies; and • leverage the NIST incident handling framework to help us respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance to provide protection against certain potential losses arising from a cybersecurity incident.

companyName: Inari Medical, Inc.


text: At the executive and management level, the CISO has primary responsibility for the architecture, implementation, and management of the Company's information security program. The CISO has approximately two decades of experience in technology risk management, including over a decade with the Company, and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor. The CISO reports directly to the Company's Chief Digital and Technology Officer. The Company's Information Security team, under the direction of the CISO, implements and provides governance and functional oversight for cybersecurity controls and services. Information Security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the CISO and the executive team as appropriate based on the severity or potential severity. In addition, regular updates from the Information Security team, in conjunction with real-time escalation on an as-needed basis, are also used to assess the risk landscape and adjust the Company's strategy and roadmap to address such risk.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: The Advisor and its affiliates also partner with independent third-party experts to provide a comprehensive cybersecurity solution that safeguards organizations against a broad spectrum of cyber threats. This comprehensive cybersecurity solution offers advanced threat detection, prevention, and response capabilities, including real-time monitoring, threat intelligence, behavioral analysis, endpoint detection and response, malware prevention, and automated response actions. Additionally, the comprehensive cybersecurity solution also provides access to cybersecurity experts, who provide proactive threat monitoring and incident response support to effectively detect, investigate, and remediate security incidents.

companyName: Lightstone Value Plus REIT IV, Inc.

ticker: LTSV


text: As previously discussed in "Item 1. Business," the Partnership is managed by GPB, through its affiliation with Highline under supervision and direction of the Receiver. Among the services provided to the Partnership under the MSA is a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program was integrated within the Partnership's enterprise risk management system as administered and overseen by Highline under supervision and direction of the Receiver and addresses the corporate information technology environment.

companyName: GPB Holdings II, LP


text: While we have not experienced any material losses relating to cyber-attacks, in 2019 we were the subject of a successful phishing attempt. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: KALA BIO, Inc.

ticker: KALA


text: The Company's Cybersecurity Leadership Team includes the CISO who is responsible for overseeing and reporting on the development and implementation of the Company's Information Security Program. The CISO has over twenty years of experience in information security for large financial institutions and has served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. The CISO currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company's Chief Information Officer, Mr. Michael A. Wisler, who is an Executive Officer of M&T and has two decades of experience in the financial and technology industries. Prior to joining the Company in 2018, Mr. Wisler served as Chief Technology Officer of North American Credit Cards and Chief Information Officer of Europe at Capital One Financial Corporation. Mr. Wisler holds a Masters of Science in Management of Information Technology from the University of Virginia. In addition, the Cybersecurity Leadership Team includes management with expertise in vulnerability management, digital forensics, threat intelligence, software development, cybersecurity operations, and project management. Many individuals on the Cybersecurity Leadership Team hold cybersecurity-relevant certifications.

companyName: M&T BANK CORP

ticker: MTB


text: We believe in transparency and open communication, promptly informing affected parties and relevant authorities as required by law. Together, we remain vigilant, adaptive, and resilient in the face of evolving cyber threats, safeguarding the trust and confidence of those we serve.

companyName: International Land Alliance Inc.

ticker: ILAL


text: A third-party security operations center, which is in operation at all times, is responsible for monitoring all logs, events, and alerts from our Endpoint Detection & Response ("EDR") platforms and cloud deployed services. This third-party also quarantines any systems displaying suspicious behavior for automatic or approved remediation. Our Information Technology Department maintains regular oversight of this third-party's actions through the monitoring of alerts displayed on the third-party's threat management dashboard to identify and respond to any irregularities that could be associated with threats. Significant threats are promptly reported to our Information Security Steering Team, who will assess the respective threat, with the help of external advisers as necessary, and initiate a plan to address it. The Information Security Steering Team will advise the General Counsel and Audit Committee of the threat as well as other third parties or authorities who are required to be notified pursuant to applicable law or contract.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: Cybersecurity is an integral part of the Company's overall risk management program. The Company takes a comprehensive approach to cybersecurity, involving key stakeholders in oversight and decision-making processes.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions under Item 1A. Risk Factors, Risks Related to our Business and Operations, "A failure or outage in our operations systems or cybersecurity attacks on any of our systems, or those of third parties, may adversely affect our financial results."

companyName: MATRIX SERVICE CO

ticker: MTRX


text: The SEC adopted rules requiring the disclosure of material cybersecurity incidents. To ensure compliance with the SEC requirement, Cars Commerce has a review process to determine whether the impact of a cybersecurity threat is material and requires disclosure of the cybersecurity incident. In compliance with the SEC rule and Cars Commerce's process, if such a cybersecurity incident occurs and the appropriate representatives from the Information Security Governance Committee determine that the cybersecurity incident is material, Cars Commerce will make the appropriate disclosures in a Current Report on Form 8-K within the required timeframe.

companyName: Cars.com Inc.

ticker: CARS


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: Checkpoint Therapeutics, Inc.


text: The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.

companyName: TCW Direct Lending VIII LLC


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. Training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.

companyName: RBB Bancorp

ticker: RBB


text: Cybersecurity Incidents Like many financial institutions, we have experienced cyber-based attacks and other attempts to compromise our information systems and we expect that we will continue to experience these attacks and attempts in the future. While we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, like all financial institutions, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risks Related to Technology—System failure or breaches of our network security, including as a result of cyber-attacks or data security breaches, could subject us to increased operating costs as well as litigation and other liabilities."

companyName: California BanCorp


text: We maintain a cybersecurity insurance policy covering costs that we may incur in connection with incidents. Our policy limits are commensurate with the size and the nature of our operations. However, Adtalem may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: Covista Inc.

ticker: CVSA


text: The Company has a formal third-party management policy that is incorporated into the overall ISMS. It includes procedures to identify, document, and address potential risks posed by third-party service providers of business-critical information systems owned or used by the Company ("Providers"). The Company assesses all Providers and will take additional steps to assess risk from Providers without an industry standard cybersecurity certification. The Company monitors the security posture of all Providers and reviews each Provider's security and service delivery performance at least annually.

companyName: SIGMATRON INTERNATIONAL INC


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: DIH HOLDING US, INC.


text: We collect, process, and analyze threat intelligence data from a variety of sources to understand motives, targets, and attack behaviors.

companyName: HERBALIFE LTD.

ticker: HLF


text: Longbridge's cybersecurity risk management and strategy is co-led by its Chief Operating Officer ("COO") and its Vice President of Information Technology ("VP of IT"). Longbridge's COO has extensive leadership experience with enterprise information technology in the mortgage banking industry, where he has held various executive roles, including Chief Privacy Officer and Chief Information Officer. Longbridge's COO has developed and executed IT strategy, including cybersecurity programs, and helped achieve and maintain Sarbanes-Oxley compliance and SOC-2 certification. Longbridge's VP of IT has extensive leadership experience with enterprise information technology, both in the banking and manufacturing industries. She has also developed and executed IT strategy, including cybersecurity programs and helped achieve and maintain Sarbanes-Oxley compliance. Longbridge's COO, accompanied by its VP of IT, regularly discusses Longbridge's cybersecurity risks and posture, and its information technology roadmap, with the Audit Committee. In these reviews, Longbridge's COO informs the Audit Committee of what Longbridge believes are the key focus items of Longbridge in its cybersecurity program and the COO and VP of IT provide an overview of their views of emerging threats, and any significant cyber response activities or incidents.

companyName: Ellington Financial Inc.

ticker: EFC


text: The Director of Cybersecurity and the Senior Vice President Global Information Systems work closely with the CEO, CFO, General Counsel and other members of management to design, implement and maintain policies, procedures and practices to protect the Company's information systems and promptly respond to any cybersecurity threats or incidents, consistent with the Company's response and recovery plans. The Global Information Services team monitors the prevention, detection, and mitigation systems in real time and reports such threats and incidents to the Director of Cybersecurity, Senior Vice President Global Information Systems, the CEO, CFO, General Counsel, and other members of management, when appropriate. The process provides for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: MANITOWOC CO INC

ticker: MTW


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified through review by our internal information technology governance, risk and compliance policies.

companyName: Innovative Payment Solutions, Inc.

ticker: IPSI


text: The Company's Senior Cybersecurity Engineer leads the execution of cybersecurity programs, including: • Developing and maintaining security policies. • Conducting periodic risk assessments and audits. • Managing incident response and recovery plans. • Providing reports to senior executives on security trends, vulnerabilities, and ongoing mitigation efforts.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our guests, business partners, associates and other stakeholders, and the processes implemented to address the risks related to cybersecurity threats are an important part of our overall risk management efforts. More specifically, we seek to address cybersecurity risks by focusing on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program focuses on the following key areas: • Governance/Board-Level Oversight: Our Audit Committee is briefed on cybersecurity risks as a standing agenda item at each regularly scheduled quarterly meeting. The Chief Information Officer ("CIO") reports quarterly to the Audit Committee and such report typically addresses an overall assessment of our compliance with our cybersecurity policies and includes topics such as risk management and control decisions, updates on our cybersecurity roadmap and self-assessment, training results, security threats, incidents (if any) and responses, and recommendations for changes and updates to our policies and procedures. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, 24x7 monitoring by a third party security operations center, and antimalware functionality and access controls, which are periodically evaluated through vulnerability assessments and cybersecurity threat intelligence. • Business Continuity and Disaster Recovery: We have established and maintain comprehensive business continuity, incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for our associates regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our information security policies, standards, processes and practices.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief executive officer and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: All employees and contractors play an important role in protecting the organization from cyber threats. We have implemented a formal cybersecurity training and awareness program that includes mandatory annual information security training and continuous education through various enterprise collaboration platforms. Our Cyber Defense team plays an important role in implementing our protection, detection, and response capabilities. Security incidents are evaluated, ranked by severity and prioritized for response and remediation. Our incident response process outlines actions required to triage, analyze, contain, remediate, and safely recover from cybersecurity incidents. Security incidents are evaluated to determine materiality as well as operational and business impacts, and are reviewed for privacy impacts.

companyName: XEROX CORP


text: cybersecurity risk management program shall include: assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; awareness and spear-phishing resistance training of our employees, and senior management; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and vendor management policy for service providers.

companyName: HeartCore Enterprises, Inc.

ticker: HTCR


text: Strategy for Handling Sensitive Data is committed to the integrity and security of the sensitive data that it collects, maintains, and transmits across its computer systems.

companyName: ARVANA INC

ticker: AVNI


text: MGIC's Information Risk Management (IRM) team is responsible for safeguarding the organization's information assets, data, and technology infrastructure from security threats and vulnerabilities. The IRM team's primary focus is the protection of the confidentiality, integrity, and availability of sensitive information and compliance with relevant laws, regulations, and industry standards.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from intentional acts of criminal hackers, hacktivists, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with an increase in the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: The audit committee receives periodic written and verbal reports from our Principal Accounting Officer and directly from the information technology department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The audit committee also receives from the Director of IT Operations and Security various written reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Broad oversight of our overall risk assessment, where we assess key risks including security and technology risks and cybersecurity threats, is maintained by our full Board. Our Board delegates to the Audit and Risk Committee oversight of our programs, policies, and procedures related to cybersecurity, information asset security, network security, and data privacy and protection. The Audit and Risk Committee reports on such matters to the full Board as needed. The Audit and Risk Committee also receives regular reports about our cybersecurity program from the Response Team described below.

companyName: Sezzle Inc.

ticker: SEZL


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: Our Information Technology team reports to senior management and is responsible for assessing and maintaining our cybersecurity risk management program. In addition, they collaborate with third-party security specialists as necessary, aiming for thorough risk assessments and system improvements. Together with our third-party security service providers, the Information Technology team oversees our processes for the prevention, detection, mitigation, and resolution of cybersecurity incidents. Throughout the year, we regularly train our employees on cybersecurity awareness and confidential information protection. We review or update our cybersecurity policies and the effectiveness of our programs to manage cybersecurity risk on a continuing basis, to account for changes in the evolving cybersecurity threat landscape, as well as for any related legal and regulatory developments that may occur.

companyName: AstroNova, Inc.

ticker: ALOT


text: December 31, 2024, we have bolstered our Board of Directors through the appointment of a Director with an extensive history in cybersecurity and a deep understanding of cybersecurity threats which may have a material impact on our business and the video game industry as a whole. Our Director of IT holds operational responsibility for cybersecurity and maintains a suite of industry-standard tools to consistent confidentiality, integrity and availability of Company systems and data.

companyName: Snail, Inc.

ticker: SNAL


text: We proactively conduct internal vulnerability scans, penetration tests, and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems. Our collaboration with these third parties includes cybersecurity audits and testing, threat assessments and tabletop exercises, along with regular consultation on security enhancements.

companyName: WORLD KINECT CORP

ticker: WKC


text: Our full Board and Audit Committee are kept informed about significant risks related to cybersecurity, including enterprise-level risks from cybersecurity threats. The Board receives written updates, generally on a quarterly basis, regarding the status of our information security program. In addition, the Audit Committee receives in-person updates on our information security programs on at least an annual basis. These updates generally cover topics such as our cybersecurity strategy, the threat landscape, key cybersecurity risk areas facing the organization, any key findings of audits and testing, the status of key initiatives, as well as a review of any major incidents.

companyName: Outset Medical, Inc.

ticker: OM


text: While the Board of Directors has the ultimate oversight responsibility for the risk management process, various committees of the Board of Directors also have responsibility for overseeing the Company's risk assessment and risk management process. The Risk Oversight Committee has specific responsibility for overseeing information technology matters, including assessing and managing cybersecurity and data privacy risks, and coordinates with the Audit Committee, which assesses and manages financial risk exposures, including cybersecurity and data privacy risks, as part of its oversight of the Company's system of internal control over financial reporting. As described above in Cybersecurity – Risk Management and Strategy, the Company's Chief Technology Officer has management responsibility for overseeing a process designed to remediate cybersecurity risks, and reports to the Board of Directors, Risk Oversight Committee, Audit Committee and management at least semi-annually. The Chief Technology Officer reported to the Board of Directors, Risk Oversight Committee and Audit Committee four times in 2023. The Chief Technology Officer has over 25 years of experience in information technology, technology research and security and operations management, with over 15 of those years focused in financial services and insurance. The Chief Technology Officer holds a Master of Science in Information Systems and a Master of Business Administration with a focus in Management and Operations. The Company has appointed a Chief Information Security Officer, who is responsible for leading the assessment and management of cybersecurity risk. In 2023, the Chief Information Security Officer made an annual report on information technology and cybersecurity risks to the Board of Directors and Risk Oversight Committee and made four quarterly reports to the Audit Committee. The Chief Information Security Officer has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA). The Chief Information Security Officer reports to the Board of Directors, its committees, and management on cybersecurity threats on a regular basis.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs at least annually.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents or technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. SLAs are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems KRIs in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors.

companyName: BankUnited, Inc.

ticker: BKU


text: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K.

companyName: Leslie's, Inc.

ticker: LESL


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's Chief Information Officer, on behalf of the ISC, provides reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company is in the process of developing its Internal Audit function. which will provide quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.

companyName: TIC Solutions, Inc.

ticker: TIC


text: Monitor Cybersecurity Incidents Our CITO and the Director of IT Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan managed by a dedicated Cybersecurity Event Response Team and Corporate Crisis Management Team. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: The Company recognizes that the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board of Directors, through the Enterprise Risk Committee ("ERC"), the Technology Steering Committee ("TSC") and the Cyber Risk Oversight Committee ("CROC"), provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the overall approach to enterprise-wide risk management. Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Information Security is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the TSC and the CROC. The Chairman of the CROC is an independent member of the Board of Directors and is considered an expert in technology and cybersecurity and provides regular updates on cybersecurity risk management to the Board of Directors.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: Park maintains a third-party risk management program that is designed to evaluate, monitor, and control risks connected with third-party vendors, particularly those vendors with access to or possession of sensitive information. The third-party risk management program solicits diligence materials from vendors and conducts internal risk assessments for vendors, including with regard to information security policies, practices, testing, and reporting. Diligence and internal risk assessments for vendors include analysis specific to the vendor's transmission and storage of information, encryption practices, security appliances, vulnerability testing, and past security incidents. Vendor contract negotiations involve data protection terms and responsibilities regarding information breach notifications and reporting.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: As of the date of our filing of this report, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, including through the use of AI, cybersecurity risks associated with our information technology systems and the systems of our customers and vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See " Item 1A. Risk Factors—Risks related to laws, regulation, and governmental compliance—We are subject to cybersecurity risks and threats as well as increasing regulation of data privacy and security. "

companyName: Transocean Ltd.

ticker: RIG


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated as primary responsible for oversight of the Company's cybersecurity risk management. As discussed below, management reports to the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks regarding financial statements or financial statements reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: We have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive, confidential and personal data. These processes are implemented and overseen primarily by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). Our CIO has over 35 years of experience and in his 19 years at NVR has been responsible for the implementation and modernization of many of our key technologies across the enterprise. Our CISO has over 25 years of experience in information technology architecture, including over 17 years with NVR in progressively more senior information security roles.

companyName: NVR INC

ticker: NVR


text: Our Sponsor's CISO leads our cybersecurity program. Their CISO has over twenty years of relevant experience, including cybersecurity and enterprise security leadership roles for large global organizations and within the U.S. government and holds a master's degree in computer and network forensics. Their CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military, some of whom are dedicated to our Advisor.

companyName: JLL Income Property Trust, Inc.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a process to conduct due diligence on third parties with which we work to oversee and identify material risks from cybersecurity threats associated with our use of those third parties' services, including those that perform cybersecurity services.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: We are a trusted partner to enterprises of all sizes, and this is a responsibility we take seriously. The secure and uninterrupted operation of our networks and systems, as well as the processing, maintenance and confidentiality of the sensitive information that resides on our systems, is critical to our business operations and strategy. Each year, we process hundreds of millions of records containing data related to individuals and businesses. In addition, certain of our products are hosted solutions, and the amount of data we store for our customers on our servers, including personal, important business and other potentially sensitive information, has been increasing. Technology-based organizations such as ours are vulnerable to targeted attacks aimed at exploiting network and system applications or weaknesses. A successful cyberattack could result in the disclosure or misuse of sensitive business and personal information and data, cause interruptions in our operations, damage our reputation and deter clients and consumers from ordering our products and services. It could also result in litigation, the termination of client contracts, government inquiries and/or enforcement actions. Any of these events could have a material adverse effect on our business, prospects, results of operations and/or financial position.

companyName: DELUXE CORP

ticker: DLX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We execute a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk management program includes a cybersecurity incident response plan and dedicated cybersecurity incident response team ("CSIRT"). We do not have actual or contractual access to the systems or information maintained by our tenants, who maintain their own cybersecurity risk management programs to protect their operations from various risks from cybersecurity threats.

companyName: SIMON PROPERTY GROUP L P


text: Comprehensive security awareness training and testing for all bank employees. Various communication strategies to communicate new and existing cybersecurity threats are used. Employees receive regular virtual and in-person security awareness training through simulated tests, online training courses, company communications, and in-person training and testing events. Training and testing efforts are included in the quarterly update to the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: The CISO has worked in the information security field for over 15 years and holds an undergraduate degree in computer systems management and master's degrees in both cybersecurity and technology management. He has also attained multiple cybersecurity-related professional certifications and licenses, including Certified Information Systems Security Professional, and is an adjunct professor of cybersecurity at New York University and Fordham University.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The Board, in coordination with the Risk Management Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Risk Management Committee discuss the Company's approach to cybersecurity risk management with the members of the Cybersecurity Council (Risk Management Team), which includes the Company's Information Technology Engineer ("IT Engineer"), Compliance Officer and Chief Financial Officer ("CFO"). The Risk Management Team continuously monitors cybersecurity risks and implements updates to enhance the Company's IT security framework. Additionally, the Compliance Officer issues quarterly reminders to all employees regarding cybersecurity practices and wire fraud prevention measures.

companyName: Emeren Group Ltd


text: Management is in the process of starting an outside third party audit of our systems, to review if there are any improvements needed from either a security aspect or personnel training to safeguard against the internal human factor that can unintentionally cause harm. Management will report on these findings in the future.

companyName: PROCYON CORP


text: Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (NIST-CSF Version 1.1), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed necessary based on updates to industry standards among other things. We have multiple layers of security designed to detect and block cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed necessary. Certain key components of our cybersecurity program include the following:

companyName: Walmart Inc.

ticker: WMT


text: We employ a proactive risk management strategy to identify, assess, track, and mitigate cyber security risks. Our risk assessment process involves continuous monitoring of our IT infrastructure, external vulnerability assessments, and reviews of our third-party relationships. We prioritize risks based on their potential impact on our operations and implement targeted controls and safeguards to mitigate identified threats.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including supervision, mitigation, and disclosure of risks from cybersecurity threats.

companyName: Sweetgreen, Inc.

ticker: SG


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment; • monitoring and reporting of those risks to appropriate levels of management; • a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India and Asia Pacific who receive a combination of general and targeted training to help keep Information Security top of mind; • a cybersecurity incident response plan and Security Operations Center for responding to cybersecurity incidents; and • a third-party security risk management process for key service providers based on their respective roles and risk profiles.

companyName: TransUnion

ticker: TRU


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: CervoMed Inc.

ticker: CRVO


text: The Company's and Hess' cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our services as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all Hess employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: Hess Midstream LP

ticker: HESM


text: Our team of cybersecurity focused employees, under the direction of our CIO, is responsible for assessing our cybersecurity risk and detecting, mitigating and remediating cybersecurity incidents. Our CIO and dedicated personnel are certified and experienced information systems security professionals and information security managers. Personnel with significant security responsibilities receive specialized education and training on their roles and responsibilities prior to being granted access to systems and resources. The pre-employment process for these roles is designed to ensure that security responsibilities are specifically defined. Our CIO has over 15 years of technology leadership experience.

companyName: American Well Corp

ticker: AMWL


text: We are subject to the risk of a cybersecurity incident. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support our operations. For additional information, see Item 1A Risk Factors for a description of cybersecurity incident risk.

companyName: Federal Home Loan Bank of Indianapolis


text: Rapidly evolving threats to the cybersecurity landscape necessitate ongoing efforts to manage the risk of unauthorized access to the Company's information systems and devices, including those of the Company and of third-party providers. The Company is subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of its security, customer and business information. The Company employs various aspects of risk assessment regularly, and to the extent possible, continuously. Further, the Company uses a defense in depth, or layered, approach to strengthen the security environment and mitigate the impact of any potential threats. Cybersecurity risks are strategically managed under the leadership of the Vice President, IT Operations and Security, who has achieved preeminent certification as a Certified Information Security Manager (CISM) and Certified Cloud Security Professional (CCSP) and has served as the most senior IT resource in many different roles.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Although our information security program is designed to attempt to prevent, detect and respond to unauthorized use or disclosure of confidential information, including non-public personal information, there can be no assurance that such use or disclosure will not occur. See "Risk Factors—Risks Relating to the Operation of Our Business—The security of our information technology systems may be compromised and confidential information, including non-public personal information that we maintain, could be improperly disclosed."

companyName: Essent Group Ltd.

ticker: ESNT