text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, implemented (i) multi-factor authentication and password protection requirements for accessing all Company systems and applications such as Company electronic mail and the Company's banking and accounting environments, (ii) a secure email gateway using GoSecure that combines machine learning, behavioral scanning, exploit detection, signature-based detection and structure heuristics to provide defense against phishing and business electronic mail compromise attacks, spam, polymorphic malware, theft and other dangerous offensive content, (iii) endpoint protection using Microsoft Defender on Company and employee computers and Company-provided devices, (iii) a physical networking room with restricted access to only authorized personnel, (iv) regular cybersecurity training, awareness, and threat updates programs to keep all Company personnel updated and informed regarding emerging threats and best practices, and (v) daily cloud backups of the Company's accounting environment. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: PEDEVCO CORP

ticker: PED


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.

companyName: LENNAR CORP /NEW/

ticker: LEN

secItem: Item 1C


text: The Audit Committee receives updates from members of management, including the Chief Technology Officer and VP Risk & Compliance, on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Response In addition to the safeguards in place to minimize the likelihood and impact of a cyber incident, the Company has established response procedures to address in the event they may occur. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents in a timely, consistent, and compliant manner. The response procedures are also designed to escalate information regarding cyber incidents promptly so that decisions regarding any required public disclosures and reporting can be made in a timely manner.

companyName: ONE Gas, Inc.

ticker: OGS


text: The Company continues to invest in cybersecurity and the resiliency of its networks and to enhance its processes and procedures, which are designed to help protect its systems and infrastructure, and the information they contain. For example, the Company is in the process of further developing its cybersecurity incident response processes and procedures to enhance its ability to identify, assess, and respond to potential cybersecurity threats. Although the Company faces cybersecurity risks in connection with its business, as of the date of this Report, such risks, including as a result of any previous cybersecurity incidents such as the cybersecurity incident described below, have not materially affected (and are not reasonably likely to materially affect) the Company, including its business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: We recognize the importance of identifying, assessing, and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K. Our risk management program is designed to detect, evaluate, and mitigate cybersecurity risks, and is informed by applicable laws, regulations, and industry best practices.

companyName: Advanced Biomed Inc.

ticker: ADVB


text: A third party Managed Security Service Provider manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.

companyName: Oaktree Strategic Credit Fund


text: Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: In addition, our internal audit team periodically tests the firm's management and oversight of certain key third-party service providers, including those overseen by the service provider oversight committee, as well as third parties that support financial reporting.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We have strong executive and board oversight of regulatory and compliance risks, including changes in laws and regulations that could affect the company's business.

companyName: Health In Tech, Inc.

ticker: HIT


text: We educate and share best practices globally with our employees to raise awareness of cybersecurity threats. As part of our internal training process, we maintain annual training for all employees on cybersecurity standards, as well provide monthly trainings on how to recognize and properly respond to phishing, social engineering schemes and other cyber threats. The Company uses advanced systems to block and analyze all email for threats, as well as equip our employees with an intuitive mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. Monthly "test" phishing emails are sent to our associates. Any failures trigger a retraining exercise if not properly reported and a monthly training vignette on cybersecurity awareness. To round out our robust awareness program, we have specific and regular training for our IT professionals, and we regularly engage independent third parties to test our information security processes and systems as part of our overall enterprise risk management program.

companyName: Crane Co

ticker: CR


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our CIO, who reports to our chief executive officer. We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards. Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.

companyName: biote Corp.

ticker: BTMD


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 28 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.

companyName: FASTENAL CO

ticker: FAST


text: Our newly acquired businesses operate with independent cybersecurity programs and processes, which may vary in scope and complexity compared to our overarching cybersecurity framework, until they are fully integrated into our unified system.

companyName: CORPAY, INC.

ticker: CPAY


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We will seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting among other processes. We will engage a third-party consultant, if needed, to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.

companyName: AI Era Corp.

ticker: AERA


text: The Sponsor provides strategic oversight regarding cybersecurity risks and threats. The Sponsor's Compliance and Risk Management Committee ("CRMC") comprised of various officers of the Sponsor and the broader Fidelity organization receives and reviews periodic reports from senior executives in Fidelity's enterprise cybersecurity organization, including Fidelity's Chief Information Security Officer ("CISO") and members of the CISO's staff. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: The CDEO or a delegate thereof informs the ERM Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's Cybersecurity Policy and related processes. The CDEO regularly reports to the ERM Committee concerning material risks from cybersecurity threats to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at FEI. We also provide additional role-based training to employees based on customer requirements, regulatory obligations and industry risks as needed.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: WisdomTree Inc.'s enterprise-wide cybersecurity risk management policies and procedures are informed by industry standards, and they are designed to address cybersecurity risks identified by external auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. WisdomTree Inc.'s team of information technology and cybersecurity professionals, led by its Chief Information Officer, or CIO, manages and maintains remediation strategies for identified cybersecurity risks.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Endeavor Group Holdings, Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 ("NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Information Security Program Our information security organization safeguards the confidentiality, integrity, and availability of our systems, services, and data. We employ skilled security and technology professionals, both internal and external, and continually invest in the resources necessary to adapt and counter evolving cybersecurity threats. Our work is overseen by the Task Force (as defined below) for strategic guidance and accountability.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: Our Director of Information Technology and Associate Director, Infrastructure Operations, help identify, assess and manage the Company's cybersecurity threats and risks. Along with our Director of Information Technology and Associate Director, Infrastructure Operations, our Senior Vice President, Corporate Operations and Legal and third-party service providers help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting vulnerability assessments to identify vulnerabilities and third-party-conducted red/blue team testing and tabletop incident response exercises.

companyName: Kronos Bio, Inc.


text: The Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. We exercise a detailed vendor due diligence evaluation during the onboarding and periodically review vendors with access to sensitive Company data. The Company requires contracts with third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see our risk factor titled "Cyberattacks and other security breaches could have an adverse effect on our business and operations, harm our reputation, and expose us to liability."

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: For additional information on our cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Liberty TripAdvisor Holdings, Inc.


text: J.P. Morgan's Information Security Program includes the following functions: • Cyber Operations, which is responsible for implementing and maintaining controls designed to detect and defend us, the Adviser, J.P. Morgan, and its affiliates against cyberattacks, and includes a dedicated function that monitors for cybersecurity threats and vulnerabilities among our, the Adviser, J.P. Morgan and its affiliates third-party suppliers. • Technology Governance, Risk & Controls, which is responsible for delivering and operationalizing key risk and control frameworks, regulatory discovery, control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk. • Enterprise Product and Line of Business Security, which oversees the cybersecurity and technology controls for business products and applications. • Assurance & Enterprise Architecture, which oversees the effectiveness of technology used in connection with cybersecurity controls, data and programs.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We foster a proactive cybersecurity culture across our organization through employee education, awareness, and engagement. This approach includes monthly e-mail phishing simulations, quarterly computer-based security awareness training on topics relevant to protecting our organization, role-based secure design and coding training, role-based security practitioner training, cybersecurity tabletop exercises, and adversary emulation exercises.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: We rely on third-party software, third-party service providers and third-party applications to run certain aspects of our business and to aid in the development, implementation and maintenance of our security measures and controls. We regularly conduct third-party security audits and use vendor management programs to ensure that third-party software, service providers and applications comply with our vendor management program.

companyName: NuStar Energy L.P.


text: We utilize on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed security services providers. These external managed security service providers collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel can identify and analyze threats.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: Information security and data protection risks are the responsibility of all employees. Markel has a mandatory training program covering a variety of security and data protection disciplines. In addition, all Markel employees are required to acknowledge annually policies on acceptable use of Markel's technology resources and enterprise information security. Contractors are required to provide certain representations and certifications relating to information security.

companyName: MARKEL GROUP INC.

ticker: MKL


text: The Company uses a multi-layered, multi-vendor cybersecurity protection structure that focuses on user security and system and infrastructure security to mitigate cybersecurity threats such as unauthorized access, cybersecurity attacks and other security incidents. These and other potential security threats may damage or disrupt our hardware and software systems, lead to a loss of data or to the misappropriation of confidential information. To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior including, but not limited to: the use of antivirus software, restrictions on installing applications directly to users' machines, the deployment of internet browsing filters, remote access using a VPN client, multi-factor authentication, network firewalls and email protection.

companyName: Trilogy Metals Inc.

ticker: TMQ


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, incident detection and response, disaster recovery plan, encryption of certain data, network security controls, access controls, asset management, tracking and disposal, employee training, penetration testing, systems monitoring and cybersecurity insurance.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The ISSC is comprised of representatives of management from various departments of the Company and members from an outside third-party information security service provider. The ISSC is led by the vCISO who oversees the implementation, coordination, and maintenance of the information security and cyber risk management program. The vCISO is a contracted third-party vendor and reports directly to the board of directors. This individual holds a Certified Information Systems Security Specialist Professional ("CISSP") certification and has over a decade of experience in community banking, risk management, compliance, and information security.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: The Cybersecurity Incident Management Team maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: Our Information Technology and Information Security teams, led by our CIO, are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes and helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. We have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to protect and continue to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of the critical information owned by, or in the care of, the Company, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer and business partner data, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage. Our information security program is integrated into our overall enterprise risk management program and shares common reporting channels and governance processes that apply to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Finance Committee, which periodically reports to the Board of Directors on its risk oversight activities. Cybersecurity is a critical component of our overall risk management program. Our Board of Directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business and Strategy" which disclosures are incorporated by reference herein.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing, assessing and considering the overall risk management policies and procedures, including our cybersecurity risk management processes, and oversight of mitigation of risks from cybersecurity threats.

companyName: aTYR PHARMA INC

ticker: ATYR


text: Our full Board of Directors oversees enterprise-level risks and has delegated to the Audit Committee of our Board oversight of risks from cybersecurity threats as informed through the ERM program. Our CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The CDO and CISO are responsible for managing risks from cybersecurity threats. The CDO and CISO provide regular cybersecurity briefings to the Board of Directors including the Audit Committee, with a minimum of two briefings per year and additional briefings as needed. The Audit Committee also has direct access to the CDO and CISO and their management teams for other updates on cybersecurity and information security strategy throughout the year. Additionally, the CDO and CISO, from time to time, meet with members of management to discuss cybersecurity risks, strategy, and threats.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Deployment of automation solutions to strengthen detection and response capabilities; and Utilizing services offered by the United States Department of Homeland Security to assist with resiliency planning.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. For more information about cybersecurity risks we face, see the risk factor titled "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" included as part of our risk factor disclosures within Part I – Item 1. Business, Item 1A. Risk Factors contained in this report.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Internal Controls, Audit, and Testing Regular internal monitoring is integral to the risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration and vulnerability testing to test the effectiveness of security controls and preparedness measures is conducted at least annually (generally quarterly for external testing and every 12 to 18 months for internal testing) or more often, if warranted by the risk assessment or other external factors. The COO and IT Manager determine the scope and objectives of the penetration and vulnerability analysis and audits.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates at least annually from senior management, including leaders from the CTO, internal audit and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our board of directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: CNL Strategic Capital, LLC


text: While we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: Hempacco Co., Inc.

ticker: HPCO


text: The Company consistently collaborates with third party experts to conduct audits, penetration testing, assessments and validations of our controls, aligning them with established frameworks like the NIST CFS. We adapt our cybersecurity policies, standards, processes and practices accordingly based on the insights provided by these reviews. These audits and assessments are useful tools for maintaining a robust cybersecurity program.

companyName: NBT BANCORP INC

ticker: NBTB


text: Investigation. Occurs when the Discovery phase establishes a likelihood that the event is an actionable security incident that warrants further research and analysis. In the Investigation phase, the priority is to swiftly complete an accurate, thorough investigation of the security incident.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Our employees are the first line of defense with respect to cyber/information security protection. Each employee is responsible for protecting Bank and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from cyber/information security threats and activities intended to compromise cyber/information security.

companyName: BankFinancial CORP


text: Cyberattacks continue to increase in frequency and magnitude generally, and cyber criminals are becoming more sophisticated, including increased usage of emerging technologies such as advanced automation and artificial intelligence. Although we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and client expectations and will continue to make significant investments to maintain the security of our and our client's data and our cybersecurity infrastructure, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective against new and/or emerging threats, vulnerabilities and techniques designed to circumvent such measures. To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, please refer to "Risk Factors " (Part I, Item 1A of this Report).

companyName: Rimini Street, Inc.

ticker: RMNI


text: We face significant and persistent cybersecurity risks due to the global nature of our business, the use of information technology systems, infrastructure and data in our business operations and our reliance on third-party vendors, suppliers, customers and business partners. We defend our systems against cybersecurity attacks on a daily basis and rely heavily on the reliability, security and efficiency of our information technology systems and ongoing employee training to face these threats. In addition, t o protect our business, we have implemented a cybersecurity risk management program with a robust governance structure and strong mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: We assess, identify, and manage material risks from cybersecurity threats under our enterprise risk assessment framework, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical systems, assets and networks, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, our Information Technology and Safety teams are responsible for protecting physical processes, safety, production, efficiency, and protection of employees. Our Information Security group is directed at protecting all aspects of data and how information is stored, transmitted, processed, and used in business processes.

companyName: Waste Connections, Inc.

ticker: WCN


text: We have a written incident response plan that is implemented by our cybersecurity incident response team, comprised of members of our information security, legal, human resources, finance and communications teams, and whose function is to respond to any such incident, define and seek to control the extent of the incident, assess and take reasonable actions intended to remediate any damage caused, and implement measures designed to prevent future reoccurrences. The materiality of any cybersecurity incident is evaluated by senior management, including the legal and finance departments, and, in certain circumstances by our third-party advisors. We periodically perform simulations (referred to as tabletop exercises) at a management level with external resources and advisors.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our CFO and MIT regularly report to and review our cybersecurity processes with the Audit Committee, with formal cybersecurity reviews with the Committee generally occurring at least annually, and sometimes more frequently, as appropriate.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K is scheduled on 2024 IT plan; • requiring regular cybersecurity training programs for employees, management and directors; • comparing our processes to standards set by the National Institute of Standards and Technology ("NIST"); • leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to model and research our adversaries; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintaining copies of production data in two separate locations; • running a backup for our data on a daily basis and these files are held for several months; • testing the backup and recovery systems frequently; • employing a multi-factor authorization for employees who are working remotely, in order to mitigate risks of compromising email accounts; and • holding an insurance policy to mitigate risks for cybersecurity incidents.

companyName: HCW Biologics Inc.

ticker: HCWB


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization ("ISO") 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials. In 2024, the Company achieved a System and Organization Controls 2 ("SOC2") Type 1 against our GovernX platforms, and we are preparing to continue maturity in this area by seeking to attain SOC2 Type 2 in 2025.

companyName: Information Services Group Inc.

ticker: III


text: Risk management and strategy Via Renewables, Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Via Renewables, Inc.

ticker: VIASP


text: As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company. As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers. In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services. These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers. Our Governance, Risk and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.

companyName: APPIAN CORP

ticker: APPN


text: We employ a number of protective measures, including firewalls, anti-virus and endpoint detection and response technologies, regular annual training of employees with respect to cybersecurity and testing employee competence with anti-phishing policies followed up by additional remedial training as needed.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: Under this framework, our information security function, led by our Chief Information Officer, helps to identify, assess and manage the Company's cybersecurity threats and risks. This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company's threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal information technology systems, or those of our third-party contract research organizations, contract manufacturing organizations and other contractors and consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability, and could adversely affect our business, results of operations and financial condition".

companyName: Turnstone Biologics Corp.


text: The Board of Directors of the Company maintains oversight of cybersecurity risks, ensuring the effectiveness of our risk management processes. The Audit Committee is specifically tasked with monitoring cybersecurity risks, evaluating our approach to cybersecurity, assessing emerging threats and ensuring appropriate measures are in place to mitigate risks.

companyName: KENNAMETAL INC

ticker: KMT


text: As part of our risk identification efforts and overall cybersecurity risk management framework, we have processes in place to assess and manage third-party service provider cybersecurity risks. Such processes include initial and periodic reviews of independent attestation reports, as well as additional evaluation and due diligence that are dependent on our classification of data stored or processed by the third-party provider.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: We recognize the risk posed by global cybersecurity threats, and our Board is regularly updated on emerging risks and maintains oversight of our cybersecurity program implemented to address them. In 2024, management provided a detailed cybersecurity update to the Board and led discussions on specific cybersecurity and process control topics at its May meeting. The Board also attended a training session led by outside counsel on the challenges public companies face with respect to cybersecurity and ransomware attacks in November.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Our cybersecurity crisis management plan outlines the items, procedures and actions we will undertake in the event of a cybersecurity incident, including detection, response, mitigation and remediation. When a potential threat or incident arises, our cybersecurity incident response team, currently consisting of one cybersecurity expert, will assign a risk level classification and initiate the necessary escalation procedures outlined in our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our Chief Financial Officer, who will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management. Our Chief Financial Officer will inform our board of directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: In the event of a cybersecurity incident impacting us, the Board of Directors will address and mitigate any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: ESH Acquisition Corp.

ticker: ESHA


text: The Company's Board of Directors recently formed a technology committee (the Technology Committee) to assume governance and oversight of HHH's cybersecurity program from the Audit Committee. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform the Board of Directors on important matters. Furthermore, the Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer, or CIO, Chief Information Security Officer, or CISO, and Chief Information Risk Officer, or CIRO, and other security staff as part of the Board's continuing education on topics that impact the Company.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Like other businesses, we have been, and expect to continue to be, subject to attempts on unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks, and intrusions and other events of varying degrees. To date, we have not experienced a material cybersecurity incident nor are we aware of any of our third-party outside service providers experiencing such an incident.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: Company's Information Security Team, led by our Director of Information Security, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company's Information Security Governance Board. The Company's Director Information Security holds high-level licenses and certifications relating to information security, including being a Certified Chief Information Security Officer and holding a BCS Foundation Certificate in Formation Security Management Principles. The Company's Information Security Governance Board, chaired by the Company's Director of Information Security and comprised of the General Counsel, the President & Chief Executive Officer, the Chief Financial Officer, and the Chief Technology Officer - Product, drives awareness and alignment across broad stakeholder groups for cybersecurity governance and risk management and reporting. The Information Security Governance Board receives quarterly reports from the Company's Director of Information Security. The Audit Committee receives at least quarterly reports from the Company's Director of Information Security. The Audit Committee periodically reports to the Board.

companyName: Inspired Entertainment, Inc.

ticker: INSE


text: We maintain a formal information security training program for all employees that includes training on matters such as security awareness, phishing, and email security best practices. Employees are also required to complete compulsory training on compliance and data privacy.

companyName: Crocs, Inc.

ticker: CROX


text: As discussed in more detail under the heading "Governance," the Board maintains an active role concerning cybersecurity risk management including oversight of the Company's employee personnel with extensive experience in the field.

companyName: Axe Compute Inc.

ticker: AGPU


text: RWT may be unable to implement adequate preventative measures or stop security breaches while they are occurring, and attackers may sabotage or to obtain unauthorized access to RWT's systems, networks, or physical facilities. Actual or perceived breaches of RWT's security measures or the accidental loss, inadvertent disclosure or unapproved dissemination of proprietary information or sensitive or confidential data about RWT, its partners, its clients or third parties could expose us and the parties affected to a risk of loss or misuse of this information, resulting in litigation and potential liability, paying damages, regulatory inquiries or actions, damage to the RWT brand and reputation or other harm to the RWT business. Additionally, cyberattacks that impacts RWT's ability to operate its platform could result in production errors, processing inefficiencies and unscheduled downtime/degradation of operations, in turn causing the loss of sales and clients, and decreased revenue and increased overhead costs, which could have a material adverse effect on our results of operations.

companyName: Rain Enhancement Technologies Holdco, Inc.

ticker: RAIN


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: We acknowledge the potential cybersecurity risks inherent in our relationships with third parties. Accordingly, PFG has implemented a third-party risk management program to identify and oversee such risks. Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third parties. Activities undertaken in relation to third parties may include due diligence inquiries, reviewing security policies and program capabilities, reviewing security certifications and results of independent audits. Review and establishment of contractual requirements is performed in accordance with the level of risk presented by a third party.

companyName: Performance Food Group Co

ticker: PFGC


text: We have not identified risks from known cybersecurity threats as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face complex risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We and our third-party providers are vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results." There can be no assurance that our cybersecurity risk management processes, including our policies, controls or procedures, will be fully implemented as currently anticipated, complied with or effective in protecting our systems and information or in allowing us to recover from a cybersecurity incident.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: The CIO presents updates to the Audit Committee as needed and, also as necessary, to the board of directors. These reports include detailed updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The CIO also promptly informs and updates the board of directors about any information security incidents that may pose significant risk to Instructure.

companyName: INSTRUCTURE HOLDINGS, INC.


text: Protecting information, including information of our customers, is a top priority. To assess, identify, and manage the risks of cybersecurity threats to our information systems and the associated costs, we maintain a cybersecurity program that: • defines cybersecurity risks that threaten the security of customer and employee data or the function of our products and services; • identify security vulnerabilities across software and hardware environments; • determine threat likelihood and potential severity of each risk; • catalog information assets to include hardware, software, and types of data the Company collects, stores, and transmits, as well as the locations where the data is stored; • assess the risk to business operations and information protection; • analyze the risk and prioritize based on financial, operational, strategic, reputational impact, and probability of occurrence; • establish security controls to eliminate or mitigate identified risks; • monitor and periodically review security controls; and • collaborate with HR for employee awareness and training.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We leverage a combination of cybersecurity frameworks to protect our assets. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs. We have a cybersecurity policy in place, which includes monthly meetings with internal cybersecurity and technology experts to review and maintain the procedures, ensuring they reflect current best practices.

companyName: USBC, Inc.

ticker: USBC


text: We recognize the increasing significance that cybersecurity has to our operations and the success of our business, as well as the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. We process and maintain sensitive data on our Clients and members, including in the form of PHI and PII. In addition, we maintain intellectual property for our solutions and personal information of our employees. Because of the data we manage, we are subject to various cybersecurity threats that, if they materialized, could adversely affect our business, employees, Clients, and members through impacts to the confidentiality, integrity, and/or availability of our systems. We maintain a cybersecurity program and controls as part of our enterprise risk management program in an effort to reduce the risk of exposure of our information and systems.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: Brunswick's Board of Directors (the Board) and its committees are actively engaged in managing cybersecurity risk and overseeing our information security programs. The Audit and Finance Committee (the Committee) is primarily responsible for oversight of Brunswick's information technology and information security/cybersecurity programs. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. The Chief Information Officer (CIO) and/or Chief Information Security Officer (CISO) update the Committee at each of its regularly scheduled meetings. These reports include updates on the Company's cybersecurity programs and key performance indicators; assessment of the program; emerging risks; policies, procedures, and training; and risk mitigation strategies. The CIO and CISO also provide the full Board with information technology and cybersecurity reports on at least an annual basis and with greater frequency as necessary. In addition, the Board oversees Brunswick's long-standing enterprise risk management (ERM) process, which regularly identifies, assesses, and mitigates enterprise and emerging risks, including cyber risks.

companyName: BRUNSWICK CORP

ticker: BC


text: We address the cybersecurity threat risk posed by employees and third parties with access to our IT systems, including that we integrate cybersecurity risk management into the culture of our organization by: maintaining policies addressing various aspects of security necessary to protect our IT assets and data; requiring cybersecurity awareness and training programs for persons with access to our IT systems to build their cybersecurity skills and knowledge; consistent messaging to our employees (including from our top leadership) of the importance of managing cybersecurity risk, participating in our cybersecurity training and following our cybersecurity policies; routinely testing responses by our employees to mock efforts to breach our cybersecurity protections; and policies and procedures to follow in the event a cyber breach were to occur at the Company, including in response to the breach and to evaluate the level and materiality of the breach.

companyName: Sylvamo Corp

ticker: SLVM


text: Our Executive Cybersecurity Council meets as appropriate and receives updates from IT manager regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including learnings from external cybersecurity incidents.

companyName: Massimo Group

ticker: MAMO


text: Our Global Computer Security Incident Response Plan (CSIRP) establishes the framework for our response to cybersecurity incidents. Under the CSIRP, cybersecurity incidents are escalated based on a defined incident categorization to the Chief Information Security Officer (CISO) and senior leaders, including the Chief Digital & Information Officer (CD&IO), General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders, such as the AFC and/or the full Board of Directors. We also conduct incident response exercises at least annually, which are facilitated by internal team members and, in some instances, with assistance from third-party experts.

companyName: CONOCOPHILLIPS

ticker: COP


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors. Per the resignation of Jay Kim and the appointment of Sungjoon Chae, the Company no longer has a majority independent board of directors. Per Nasdaq rules we are not required to have a majority independent board but must still comply with certain subcommittee requirements. We may in the future appoint one or more duly qualified independent directors to fill the current vacancy. See "Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance and Board Structure"

companyName: Vestand Inc.

ticker: VSTD


text: The Company's enterprise-wide technology risk management (ETRM) function acts as the second line of defense and provides independent risk oversight for the Company's technology operating infrastructure and operations. The ETRM function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Company's internal audit department acts as the third line of defense, providing the independent assurance function.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: The CIO and the other members of senior management play a key role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of twice per year. These briefings encompass a broad range of topics, including emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and updates regarding compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and other members of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity field, ensuring the Board's oversight is proactive and responsive. Senior management actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives, and is involved in incident materiality determinations that would trigger cybersecurity incident disclosure obligations. This active involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: Century Communities, Inc.

ticker: CCS


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we follow our third party vendor review processes involving stakeholders throughout the company. This includes multiple levels of due diligence prior to an engagement to assess what, if any, user data or confidential information the vendor may receive access to, what controls should be implemented around such access, and validating that the contractual rights and obligations conform to our policies and practices.

companyName: Grindr Inc.

ticker: GRND


text: Board of Directors Oversight of Cybersecurity Risk Management Our Board has ultimate oversight of cybersecurity risks as part of our enterprise risk management program, including oversight of the processes implemented by OFS Advisor and the IT Department to identify, assess, manage and mitigate cybersecurity risks. The Board receives quarterly updates from senior management of OFS Advisor and the IT Department with respect to the effectiveness of the cyber readiness and cybersecurity program that the IT Department administers on our behalf. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by the IT Department and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by the IT Department, the health of our information security system, effectiveness of our cybersecurity controls and recoverability and business continuity testing.

companyName: OFS Capital Corp

ticker: OFS


text: Our processes to assess, identify and manage cybersecurity risks, including cybersecurity risks related to the use of third-party service providers, are fully integrated into our Enterprise Risk Management Program. In some circumstances we use third-party service providers to provide expertise and to monitor utilization of specific cyber tools, and in certain cases, to supplement staffing services. Through our vendor risk management process, these vendors undergo various assessments such as financial, reputational, contractual and informational security. These assessments are performed to ascertain that these vendors meet our policy requirements relative to the services they perform on our behalf.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: The second-line independent risk management, including compliance, enterprise risk management, and operational risk management, works with the first line ECSO to evaluate, assess, and manage material risks using an established Risk Appetite Framework that is designed to require that the cybersecurity organization appropriately document the current risk landscape and the activities undertaken to mitigate risk that falls outside of the enterprise risk tolerance. The third-line in the Three Lines Model is our internal audit team, which assesses the effectiveness of related controls.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: We conduct systematic and manual assessments designed to identify information security vulnerabilities, such as external party penetration tests, internal manual penetration tests, source code scanning and other techniques. We perform information technology risk assessments on a periodic basis designed to detect risks for which controls and mitigation strategies are developed.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related. We analyze these risks based on numerous factors and also weigh their likelihood and potential impact. This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under "—Governance." Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management ("ERM") program. Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology. Our ERM Committee is comprised of Company leaders who meet to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: The effectiveness of our cybersecurity operations is regularly examined and tested by third-party vendors who specialize in cybersecurity risk management. We regularly employ such vendors to test the effectiveness of our security controls, including penetration testing. External vendors are engaged at least on an annual basis to facilitate incident response exercises and training. We use external risk management services to assess and monitor cybersecurity risk associated with third-party service providers. Finally, we review the maturity of our program's design and control environment's effectiveness through regular internal assessments and examinations.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Our IRP also describes processes to identify material risks from cybersecurity incidents associated with our use of third-party service providers.

companyName: Coterra Energy Inc.

ticker: CTRA


text: We engage consultants, auditors, and other third parties in connection with such processes. We work with third-party service providers to assist us in our cybersecurity risk management to identify areas that may potentially impact our business, develop and implement control framework to mitigate such cybersecurity risks, and to be prepared to respond to and report (as required) applicable cybersecurity incidents.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: When we experience cybersecurity incidents, we promptly activate incident response protocols and commence investigation of the incident. We may notify law enforcement and engage third-party professionals, as appropriate, as part of our incident response and/or investigation. Based on our assessments, we have not identified any cybersecurity threats that have had a material impact during the last fiscal year, and we do not believe these incidents have materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: Intapp, Inc.

ticker: INTA


text: The Company's information security program is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software and information assets, including client and other sensitive data. The program is comprised of policies, guidelines, and procedures. These policies, guidelines, and procedures are intended to align with regulatory guidance, the ISO Code of Practice for Information Security Controls, and common industry practices. Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: Incident Response and Vulnerability Management In the event of a cybersecurity incident, our incident response plans are designed to respond with an incident response team to address any breaches. Our ongoing vulnerability management program complements our incident response capabilities. It includes periodic scanning, risk assessment, and patch management to address system and network vulnerabilities and help ensure that our infrastructure remains resilient against evolving threats.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Cybersecurity is a significant and integrated component of Cullman Savings Bank's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, we have not, to our knowledge, experienced an incident materially effecting or reasonably likely to materially affect Cullman Savings Bank.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: We act as a trusted business partner in providing both front-office and back-office platforms. As part of our business process outsourcing solutions, we develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases and system software solutions. We also receive, process, transmit and store substantial volumes of personal information relating to identifiable individuals. Additionally, we receive, process and implement financial transactions and disburse funds on behalf of both commercial and government customers.

companyName: CONDUENT Inc

ticker: CNDT


text: The Company's' Cybersecurity Policies are updated annually and reviewed by Independent 3rd Party Vendors to certify compliance. The Company requires Cybersecurity Awareness training for all new hires and a minimum of an annual review of such policies for all employees. The Company created and deployed an extensive Learning Management System that tracks employee adherence to Cyber Security Awareness, HIPAA and other related content. The Company's' Cybersecurity Incident Response Policy provides specific steps for any employee that detects an attack to take to help stop the propagation of the threat and report the incident to their Superiors, the IT Team and the Security Manager.

companyName: iCoreConnect Inc.


text: As of December 31, 2023, and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual report on Form 10-K.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: Identification of sources and types of technology threats Tools and processes to manage technology security, such as change control approval, employing a Unified Threat Management System, and usage of anti-virus and anti-spam hardware Ongoing security assessments conducted by third -party vendors, such as vulnerability assessments and penetration testing, and mitigation of any findings Continuous firewall monitoring provided by a third -party vendor Information security training for employees provided by a third -party vendor Annual security audits of third -party vendors Our Information Security Governance Plan ("InfoSec") is a component of the ISP and provides for strategic oversight of critical aspects of the Bank's information security. The objective of InfoSec is to provide a framework for decision-making and accountability for information security issues to ensure that the ISP is actively monitored, and information security permeates through all areas and initiatives across the organization. InfoSec is actively managed by an InfoSec Governance Council ("ISGC") that consists of the Chief Risk Officer ("CRO"), virtual Chief Information Security Officer ("CISO"), Chief Strategy and Innovation Officer ("CSIO"), a cybersecurity focused systems engineer, and the CIO. The CRO, CISO, and CIO are part of the ITSC, along with other executives of the Bank.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: We conduct periodic training to keep personnel informed of cybersecurity threats and to communicate evolving information security policies, standards, processes, and practices. Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to members of management, including to our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee. Our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee work with our incident response team to mitigate and remediate potential issues. These processes include reporting significant cybersecurity threats, risks, and mitigation activities to the Audit Committee and/or the Cybersecurity Committee, as appropriate.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Head of Security. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Weave Communications, Inc.

ticker: WEAV


text: The TVA Board is ultimately responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk, and receives reports from the Audit, Risk, and Cybersecurity Committee ("Audit Committee"). The Audit Committee is a standing committee of the TVA Board and advises the TVA Board on a variety of matters, including TVA's processes for identifying, monitoring, and mitigating enterprise risk and reviewing and overseeing strategies for addressing TVA's cybersecurity, data, and privacy policies and response protocols. The Audit Committee meets at least quarterly. Reporting to the Audit Committee and the TVA Board is the risk council comprised of TVA's top leaders and the Chief Risk Officer ("CRO"), which is responsible for the highest level of management oversight of risk at TVA. The risk council's primary purpose is to oversee TVA's management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk council oversees a subordinate committee that provides comprehensive risk oversight of TVA's security, artificial intelligence, privacy, and technology risks consistent with TVA's mission, strategic imperatives, and approved financial and operational plans.

companyName: Tennessee Valley Authority

ticker: TVE


text: In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Incident and Risk Escalation to Board The Board Risk Oversight Committee oversees the ERC and works directly with the ERC to facilitate effective risk management and timely escalation of substantive issues from ERC and ERC's sub-committees, including Operational Risk (which includes information technology and cybersecurity). Quarterly, cybersecurity updates are provided to risk and board committees including, but not limited to, the following materials: Annual GLBA Report, Information Security Metrics (including Key Performance and Key Risk Indicators), Penetration Testing and Tabletop Exercise updates, Cyber Maturity Assessments/Roadmap, Annual Threat Landscape Report, and additional cybersecurity education topics.

companyName: Independent Bank Group, Inc.


text: In conjunction with management, the head of global cybersecurity regularly reviews risk management measures to identify and mitigate data protection and cybersecurity risks. Key performance indicators, emerging threats, current trends and notable detections are reported to members of the Company's senior leadership team. The global cybersecurity team also works closely with our legal team to address legal, regulatory and contractual requirements.

companyName: ESAB Corp

ticker: ESAB


text: We require third-party service providers to certify their ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect the Company.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: These events could lead to the unauthorized access of our information technology systems and result in financial loss and the misappropriation or unauthorized disclosure of confidential information belonging to us, our employees, partners, customers, or suppliers. The techniques used by criminal elements to attack computer systems are sophisticated, change frequently and may originate from less regulated and remote areas of the world. As a result, we may not be able to address these techniques proactively or implement adequate preventative measures.

companyName: Beyond Air, Inc.

ticker: XAIR


text: The Information Security Program, overseen by our Executive Project and Technology Risk Committee ("EPTRC"), plays a vital role in our overall risk management system. It encompasses administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Our Board regularly interacts with our Chief Information Security Officer and other members of management on cybersecurity risk management.

companyName: BOYD GAMING CORP

ticker: BYD


text: We leverage guidance from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which provides an outline of enterprise security processes and controls, to inform the design and assessment of our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Key Principles of the Cybersecurity Risk Management Program: • Risk Management - a proactive approach to identifying and mitigating risks to protect the organization's assets and integrity through third party assessments, internal assessments and global cybersecurity threat analysis. • Defense Strategy - adopts a robust defense approach to protect systems from potential threats, including an assumption of breach mindset. • Zero-Trust Architecture - implements a zero-trust philosophy, ensuring that no entity is inherently trusted without verification. • Least Privileged Access - employ strict identity and access management principles to limit user access based on necessity. • Mitigation and Management of Incidents or Disasters - our risk management program includes policies and procedures for incident response and mitigation.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Incident Response Planning: The Company has established, maintains and regularly tests incident response plans that address the Company's response to a cybersecurity incident. The Company also has a cybersecurity risk insurance policy.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Cybersecurity Risk Management and Strategy KKR's asset management business has a cybersecurity incident response plan, which was developed taking into account industry standard guidance provided by institutes such as the National Institute of Standards and Technology. This plan is a key component of the cybersecurity program, which is generally incorporated within our enterprise risk management framework. The KKR CISO and KKR's Chief Compliance Officer co-chair a cybersecurity incident response team ("KKR CIRT"), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR's asset management business, including those arising from third-party service providers, including those providers that have access to KKR's customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform cybersecurity-related diligence on third parties that have access to our systems, data or facilities. In addition to the KKR CISO and our Chief Compliance Officer, the KKR CIRT includes members of the firm's legal, technology, compliance, risk, public affairs, human capital and finance groups. KKR has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including the Risk and Operations Committee, senior members of management, and our Board of Directors or its committees.

companyName: KKR & Co. Inc.

ticker: KKR


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales." We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.

companyName: QUALYS, INC.

ticker: QLYS


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, the Company has not been subject to any material cybersecurity incidents. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Sitio Royalties Corp.


text: We operate in a highly-regulated industry. Federal, state and international laws and contractual commitments guide our collection, use and disclosure of confidential information such as protected health information, personal financial information and personally identifiable information. Our success depends on maintaining a high level of trust among our stakeholders, including our consumers, clients, business partners, providers, regulators and associates. Failure to effectively secure, maintain and upgrade our information systems, or the availability and integrity of our data, could adversely affect our business, including our business strategy, cash flows, financial condition and results of operations.

companyName: Elevance Health, Inc.

ticker: ELV


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers, manufacturers and other third parties who have access to patient and employee data or our IT systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and we continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: Hyperfine, Inc.

ticker: HYPR


text: The Advisor and its affiliates have developed and implemented policies to identify and mitigate cybersecurity risks and provide training to their employees at onboarding and thereafter as necessary. Such updates are communicated to all their employees, and actionable guidance is provided when new risks arise.

companyName: Lightstone Value Plus REIT II, Inc.


text: Our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with our Chief Information Security Officer ("CISO"), Chief Privacy Officer, Cyber team, Legal team, Physical Security team, and Content Management team, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. We conduct monthly Cyber Risk Committee meetings with the participation of these teams to review risks in each of those functions and any cross-functional risks. The Cyber Risk Committee also reviews the industry landscape at these meetings to help ensure we are aware of global and industry cyber activities.

companyName: Warner Music Group Corp.

ticker: WMG


text: The Company's Technology and Information Security Committee ("TISC") oversees the governance of the Company's enterprise technology and information security programs, including strategy, management principals, risk and compliance. The TISC reviews the policies, strategy, emerging topics, risks and general compliance of the programs to ensure they are adequate and sufficient to govern and manage the associated risk of the Company. The TISC coordinates and communicates with the Audit and Risk Committee on risk-related items through Company's Enterprise Risk Management Committee. The TISC provides a forum for advising and sharing information among members of the Company's senior leadership team and is compromised of Company risk owners with expertise across a wide range of financial, technical, operational, strategic, and cybersecurity skill sets. The TISC is co-chaired by the Chief Technology Officer, who is responsible for the enterprise-wide information technology program and the Information Security Officer, who is responsible for the enterprise-wide information security program. The Information Security Officer is a Certified Information Systems Security Professional (CISSP), with over 20 years of experience in a combination of information technology and information security roles. The Information Security Officer has over eight years of leadership experience in the field of information security, and holds a Bachelor's degree in Information Technology, with an Associate's degree in Computer Network Management.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: We maintain an incident response policy and program focused upon detecting, managing, documenting and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we appoint a dedicated incident team, including a team leader, responsible for managing and coordinating incident response efforts. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). The Company uses recognized frameworks from the National Institute of Standards and Technology as guidelines to inform its cybersecurity policies, standards, and practices. We generally approach cybersecurity matters through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.


text: Our board of directors has delegated oversight responsibility for risk management, including cybersecurity risks, to our audit and risk committee, and such responsibilities are set forth in the audit and risk committee's charter. At routine board meetings, the chair of the audit and risk committee regularly provides a report to the full board on the committee's oversight activities.

companyName: COMPASS Pathways plc

ticker: CMPS


text: We have a cybersecurity Incident Response Plan (IRP) that sets forth a process designed to effectively respond to an incident by obtaining information, coordinating activities, assessing results, and communicating applicable developments to our stakeholders, including employees, law enforcement, other external parties and agencies, and our Board. The IRP includes the following major components: preparation, detection and analysis, containment, eradication, notification, recovery, reporting, and lessons learned. Specific technical and legal playbooks have also been developed for data breaches, malware, unauthorized remote access, and ransomware. We have also retained certain third-party experts to assist us with various aspects of incident assessment and response in the event those services become necessary or useful.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Risk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and Managed detection and incident response, including advanced endpoint protection and data loss prevention.

companyName: Seneca Foods Corp

ticker: SENEA


text: We have implemented cybersecurity programs designed to maintain and protect our information technology systems and the confidentiality, integrity, and availability of our data. These programs serve to maintain compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: We recognize the ever-evolving nature of cybersecurity risks. Our cybersecurity risk management program is informed by recognized industry standards and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework. MeridianLink also conducts periodic penetration testing and operates a bug bounty program in an effort to expose weaknesses in our applications, networks, and systems before they can be exploited by malicious actors. Our Governance, Risk, and Compliance, or GRC team, in close collaboration with our Security Operations and Engineering teams, monitors and mitigates evolving risks from cybersecurity threats, prioritizing alignment with our business objectives and operational needs. We view cybersecurity risk management as a shared responsibility, and at a management level, we periodically perform tabletop exercises which simulate real-world cyberattacks.

companyName: MeridianLink, Inc.


text: Ameren's cybersecurity program and team are led by the Chief Information Security Officer, who possesses 25 years of critical infrastructure experience both managing and protecting information systems in concert with extensive cybersecurity operations and leadership roles. The Chief Information Security Officer regularly engages with senior-level Ameren officers, reports to the risk management steering committee, and has recurring meetings with the Cybersecurity and Digital Technology Committee as part of ongoing risk management and oversight of the cybersecurity program. Ameren's board of directors is also regularly updated on its cybersecurity program. In addition, the board of directors participate in periodic cybersecurity drills to prepare for potential crisis scenarios.

companyName: AMEREN CORP

ticker: AEE