text: When a potential incident is first detected, the matter is communicated to the CFO as soon as possible so that the Company may work quickly and diligently to re-secure its systems and work to minimize any damage and further risk to it as a result thereof. Upon receipt, the CFO is charged with immediately investigating the report to ensure the existence or possibility of a cyberattack and employs every effort toward thwarting or limiting a cyberattack, if ongoing, to the fullest extent possible to avoid further damage and exposure to the Company and its systems. As soon as an immediate threat or cyberattack is sufficiently contained to permit it, the CFO notifies the Chief Executive Officer of the situation, who is charged to direct the CFO on any additional or special measures to be taken, including but not limited to a Company-wide alert or directive, which the CFO must follow/implement without delay. Questions or concerns relating to a directive's validity may be confirmed only by the CFO, or a designated executive officer, through a known form of contact not questionably in breach. As soon as reasonably practicable after response efforts commence, the designated executive officers are required to notify the Chair of the Audit Committee of the situation and to thereafter keep the Chair apprised of all material developments, who may escalate the matter to the full Board in the Chair's discretion. Our emergency response plan also sets forth our procedures for a transition back into normal work practices, as well as security incident investigation, remediation procedures, security incident recovery and mandatory reporting.

companyName: ZeroStack Corp.

ticker: ZSTK


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors oversees our cybersecurity risk management. The Company's Audit and Finance Committee periodically reviews with management the Company's operational risk exposure related to cybersecurity and information technology and the steps management has taken to monitor and control these exposures, including the Company's related guidelines and policies.

companyName: HAWAIIAN HOLDINGS INC

secItem: Item 1C


text: Our CISO also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: We face a number of cybersecurity risks in connection with our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We and the third parties with whom we work rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems, or our data, could have a material adverse effect on our business, including by not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" in Item 1A- Risk Factors.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: SSG and Key Personnel We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Vice President of Cloud Technology. The SSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program. The SSG meets at least quarterly. Our CISO chairs the SSG and decisions and recommendations are based on a consensus of the members.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are overseen by our cybersecurity committee, which is led by our Vice President, IT and is comprised of a cross-functional team which includes our Chief Financial Officer and General Counsel, along with other members of our IT, legal, finance and internal audit departments. To facilitate our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Our cybersecurity committee meets on a regular basis and is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: Inari Medical, Inc.


text: We strive to implement and maintain layered controls designed to prevent and, where necessary, detect and respond to cybersecurity threats. Our physical controls are designed to restrict access to locations that house significant physical information technology assets. Our technical preventive controls include access restrictions and network security technologies. Our notification policies and processes are designed so that notifications and alerts are escalated to the appropriate personnel on a timely basis to support effective review, response and compliance with legal requirements. In addition to event-specific notifications, data is aggregated and compiled on a regular basis to support the identification of trends and effective program review and oversight. We also recognize that Danaher is exposed to cybersecurity risks that affect third parties whom we rely on to process, store or transmit our electronic information. To manage these risks, we maintain technical security controls as well as processes designed to facilitate Danaher's identification of third-party cybersecurity risks.

companyName: DANAHER CORP /DE/

ticker: DHR


text: • Routine Evaluation and Assessment of Systems and Processes. We routinely evaluate our IT systems and infrastructure, including with respect to system security, and regularly implement upgrades to improve system functionality and performance as well as to enhance security. Security controls are routinely assessed by our annual general controls audit and other audits and assessments as well as a thorough assessment performed during the annual cyber insurance application process. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on a regular basis with the goal of identifying and remediating real and potential threats as they arise. • Security Awareness Program to Train and Test Personnel. We operate a security awareness program that includes regular, mandatory trainings for relevant personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Incident Response Process and Team. We maintain an incident response process with defined roles, responsibilities and reporting protocols. This process focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the IT Security Team would escalate the issue to the Council for initial analysis and guidance. In the event of a serious IT incident, the crisis management team would be notified and the incident response team would typically be tasked with preparing an initial response. The incident response team, in consultation with others regarding impact and materiality, would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The IT Security Team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit and Finance Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Our IT Steering Committee is responsible for reviewing, approving and funding IT projects, including cybersecurity initiatives. This committee consists of five (5) members: the Chief Information Officer, the President and Chief Executive Officer, the Chief Financial Officer, the Chief Operating Officer, Government Services and the Chief Operating Officer, Offshore Energy Services.

companyName: Bristow Group Inc.

ticker: VTOL


text: We maintain formal processes for our cybersecurity program and incident response procedures, which are updated at least annually and reviewed by external legal and cybersecurity advisors. These processes include, among other things, detailed steps on how we assess cyber risks, identify threats, and determine the materiality of cyber incidents. These processes also designate certain roles within the company to execute these policies and certain leadership roles to manage material risk escalation. These processes endeavor to follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and are tested at least annually.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Board of Directors, through its Risk Committee, reviews and approves the Company's risk management framework, including reviewing the overall risk appetite, risk management strategy and policies and practices established by management to identify and manage the risks we face. In addition, other Board committees are responsible for overseeing certain risks under their respective charters.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Our CISO and other members of senior management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such material cybersecurity incident.

companyName: SYNOPSYS INC

ticker: SNPS


text: To strengthen the Company's cybersecurity readiness, the Company has developed a cybersecurity incident response policy and a cybersecurity incident response plan in partnership with various internal department functions and third-party IT consultants. Our cybersecurity incident response plan is based on the NIST incident response lifecycle and co-led by our CISO and director of information security. Our cybersecurity incident response plan has a designated incident response team composed of management members from select departments who each play a role within the four phases of the plan that include preparation, detection analysis, containment, eradication, recovery and post-incident activity. Each phase provides a detailed list of actions and responsibilities for each department to assist in responding to a cybersecurity incident. In the event of a cybersecurity incident, as provided in our cybersecurity incident response plan, a root-cause analysis will be conducted and based on the findings, certain new or improved processes and procedures may be implemented to continually improve the security of our IT systems and confidential data. Additionally, the Company's incident response team conducts an annual table-top exercise, utilizing the cybersecurity incident response plan and makes improvements on the response plan based on new learnings. Senior management and Board-level table-top exercises have also been conducted to further prepare and support the Company with responding to and mitigating the effects of a cybersecurity incident. The Company has further implemented a business continuity and disaster recovery plan where critical systems are backed-up daily and incrementally and stored in an encrypted format in multiple secure locations.

companyName: MASONITE INTERNATIONAL CORP


text: Outside Consultants: Third party experts are engaged to conduct National Institute of Standards and Technology (NIST) CSF (Cyber Security Framework) Audits to measure the Company's cybersecurity maturity level, in addition assistance with our cybersecurity risk management and strategy. Other third-party providers provide us with ongoing assistance including threat monitoring, mitigation strategies, and updates on emerging security trends and developments while we have others engaged on retainer to provide targeted assistance forensic expertise as needed.

companyName: CELESTICA INC

ticker: CLS


text: Our Information Security function is overseen by our Chief Security Officer, or CSO, and is supported by our Chief Information Officer, Product Engineering Team Lead, Chief Legal Officer, or CLO, and Head of Global Privacy. Our information security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile using various methods. These methods include conducting vulnerability assessments and threat assessments in certain environments for internal and external threats, scanning certain threat environments, analyzing certain reports of threats and actors, conducting internal audits for certain systems, evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third-party service providers to conduct external audits, and threat assessments for certain systems, provide intelligence feeds, and conduct red/blue team testing and tabletop incident response exercises.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Risk and Issues Disclosure We describe the risks we face, including cybersecurity risks, in Section 1A above, titled "Risk Factors". For the period covered by this Annual Report on Form 10-K, we are unaware of any specific cybersecurity threats that have materially affected the Company, its business strategy, results of operations or financial condition.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Our Board of Directors has designated the Audit Committee to oversee risk management associated with cybersecurity threats. The Audit Committee is comprised of board members with diverse expertise including risk management, technology, and finance, which we believe enables them to oversee cybersecurity risks.

companyName: Liberty Energy Inc.

ticker: LBRT


text: We have a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. These security measures include controls, security processes and monitoring of our manufacturing systems. We have cloud security tools and governance processes designed to assess, identify and manage material risks from cybersecurity threats. In addition, we maintain an information security training program designed to address phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Chief Financial Officer who reports to the Audit Committee at the board-level, as appropriate.

companyName: Regenerative Medical Technology Group Inc.

ticker: RMTG


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Our informational technology consultant leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our informational technology consultant has over 34 years of experience working with companies in the information technology field.

companyName: Vivakor, Inc.

ticker: VIVK


text: Risk Management and Strategy and Governance We are committed to protecting the security and integrity of our systems, networks, databases, and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Cybersecurity and risks related to our IT are an important focus of our board of directors' risk oversight. Our board of directors, with assistance from its audit committee, oversees our cybersecurity risk assessment and response program. The audit committee receives reports at least quarterly from executive management, including our Senior Vice President of IT and Cybersecurity, on the identification and status of cybersecurity incidents, resolution, recovery, and post incident management.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: The Company uses reporting and metrics frameworks and regular internal and external oversight to assess the health of the cybersecurity risk program. At the first level, the ISS team identifies, assesses, and manages cybersecurity risk and threats. The Company manages cybersecurity issues and findings through remediation and/or closure, with escalation processes if an issue or finding cannot be remediated within required timeframes. The Company engages external assessors, consultants, and auditors to review the Company's cybersecurity risk program against those of industry peers. The Company also uses consultants periodically to provide recommendations to improve and enhance the program. Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standards (PCI DSS), and other applicable standards, laws, and regulations.

companyName: US BANCORP \DE\

ticker: USB


text: In addition, we have continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Accordingly, we have implemented processes for overseeing, detecting and identifying material risks from cybersecurity vulnerabilities and threats, and technical, process, and people related security controls designed to mitigate material cybersecurity risks. We also maintain an Incident Response Plan, which defines the procedures for evaluating, and reporting cybersecurity incidents to executive leadership. The Incident Response Plan also creates a framework and delegates tasks to appropriate personnel for responding to a cybersecurity incident based on the severity of an incident. These processes are integrated into our overall risk management strategy.

companyName: Leafly Holdings, Inc. /DE


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our IT systems is important to our operations and business strategy. We understand the growing challenges associated with cybersecurity threats and have established a strong cybersecurity program intended to continue to monitor and improve our cybersecurity posture.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: We also have a trained response team lead by the CISO, consisting of key individuals from executive management, finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate. Additionally, we engage a third party that offers cybersecurity solutions, monitoring and incident response services for additional support.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our and our Manager's enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of trustees to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Additionally, we require security training for all employees on a quarterly basis. The training covers a wide range of topics, including phishing, social engineering and data protection.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: The outsourced Chief Information Security Officer ("CISO") works closely with the Chief Financial Officer to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.

companyName: Apyx Medical Corp

ticker: APYX


text: The Company's Board of Directors has oversight of risks from cybersecurity threats. The Board reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. The Board relies on management and its use of the third-party consultants for expertise for assessing and managing the Company's risks from cybersecurity threats. In conjunction with management, the Board considers the nature of the work provided by the Company's operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: MYR GROUP INC.

ticker: MYRG


text: Processes continue to strengthen our cybersecurity measures to safeguard our information systems based on industry standards. Our measures include policies to promote internal compliance by our employees, policies and procedures to regularly evaluate the security of our information systems and implementation of third-party products, including intrusion prevention and detection solutions, multifactor identification and anti-virus software, to help detect and protect against potential cybersecurity threats. We educate our staff on cybersecurity matters with periodic risk awareness information, phishing awareness campaigns, and training materials. Moreover, given the rapid growth of our global operations in 2023 due to the Ibeo acquisition, and our expectations for near- and long-term strategic growth, our Information Technology, or IT, team is prioritizing enhancements to our response system and continuity plans.

companyName: MICROVISION, INC.

ticker: MVIS


text: We have not experienced any material cybersecurity breaches or incidents to date, but we cannot guarantee that we will not suffer any such breaches or incidents in the future.

companyName: TELIX QSAM INC.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including R. LaDuane Clifto n, Chief Financial Officer, Secretary and Treasurer, i s responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our r etained external cybersecurity consultants. Our management team includes IT staff with more than 40 years of combined experience in various roles involving managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures; Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP;

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Chief Information Security Officer (CISO), who reports to the Chief Information Officer (CIO), is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and through the use of technological tools and software and results from third-party audits. The CISO has a clear escalation path to senior management for cyber-related events.

companyName: AVIENT CORP

ticker: AVNT


text: Monitor Cybersecurity Incidents Our CLCO, our COO, and our IT personnel are periodically informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CLCO and COO implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CLCO and COO, along with our IT personnel, are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company's policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy.

companyName: Primerica, Inc.

ticker: PRI


text: Company is actively engaged in identifying and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see Risk Factors - "Our internal computer systems, or those of third parties with which we interact, may fail or suffer security breaches, which could result in a material disruption of the development of our product candidates and research programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business," in Item 1A of this Annual Report on Form 10-K.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Investment Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: We do not believe that risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that materially affects us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, privacy and data protection laws and regulations, consumer protection laws, common law or other theories, subject us to litigation and federal and state governmental inquiries and actions, damage our reputation, adversely impact our financial results and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks, and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, threat monitoring and tabletop exercises to inform our risk identification and assessment.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Information Security is the responsibility of the officers, employees, and agents of the Company with oversight by the Board of Directors ("BOD"). Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. The Company's Chief Information Officer ("CIO") has over 25 years of network architecture, information technology and cybersecurity experience. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy.

companyName: Oak Valley Bancorp

ticker: OVLY


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries including real estate, global retail, fintech and insurance along with experience working for several top IT service and solutions providers.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: We retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our president and chief operating officer, to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with the Company since the Company's inception and has over 25 years of experience in cybersecurity.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: We have established plans to conduct periodic reviews and tabletop exercises to test various processes for preparedness in the event of a critical cybersecurity incident as well as include cybersecurity risk within our Enterprise Risk Management Framework. As part of our overall risk management strategy, we have secured comprehensive cyber insurance coverage. We regularly review and update our cybersecurity insurance coverage to align with the evolving nature of cyber threats and industry standards.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the internal cybersecurity team and others, depending on severity. The cybersecurity team works with our incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Personalis, Inc.

ticker: PSNL


text: We devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our newly acquired businesses and consolidated bottling operations maintain separate cybersecurity programs and processes that may differ in scope and complexity from the Company's overall cybersecurity programs and processes. However, for all consolidated entities, our cybersecurity risk management program is designed to help coordinate the Company's identification of, response to and recovery from, cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as to comply with applicable legal obligations.

companyName: COCA COLA CO

ticker: KO


text: The CTrO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CTrO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Committee and Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.

companyName: Salesforce, Inc.

ticker: CRM


text: We are committed to safeguarding against both internal and external security threats through a robust counterintelligence and insider threat program that utilizes cutting-edge data analytics and machine learning. As a defense contractor, we are subject to the Department of Defense's cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement, ensuring the protection of Controlled Unclassified Information and prompt reporting of cybersecurity incidents. Our practices have been rigorously assessed by the Defense Contract Management Agency to meet the Level 2 Cybersecurity Maturity Model Certification requirements, reflecting our dedication to maintaining stringent security controls.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Engagement of Third Parties The Company utilizes third parties for some cybersecurity services, including but not limited to managed security services, external and internal penetration testing, social engineering tests, third party risk reviews and tabletop exercises.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are part of the Company's overall risk assessment efforts. The Company has established controls and procedures, including an incidence response plan, that provide for the identification, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company continues to review its Cybersecurity program and controls and procedures as part of its efforts to strengthen its defenses.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks we face, please refer to Part I, Item 1A "Risk Factors—Risks Related to Employee Matters, Managing Growth, Public Health and Information Technology—Security breaches and other disruptions to our information technology structure could compromise our information, disrupt our business and expose us to liability, which would cause our business and reputation to suffer" of this Annual Report on Form 10-K.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners. In the last three years, we did not experience any material cybersecurity incidents or threats.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Our Vice President of Global Security, Darren Remblence, reports to Ms. Van Horn and is responsible for the development of strategic direction, execution, and day-to-day management of global security. Mr. Remblence has more than 20 years of international experience and expertise in information security, cybersecurity, physical security, IT operations, investigations, business continuity and disaster recovery. Prior to joining us, Mr. Remblence worked at PayPal Inc., eBay Inc., The London Clearing House Ltd, Centrica Plc. and DHL International (UK) Ltd. He also served 14 years in the British Royal Air Force, where he specialized in cybersecurity and counterintelligence. He received his Master of Science in IT security from the University of Westminster, London and holds CISM (Certified Information Security Manager) and CISSP (Certified Information Systems Security Professional) certifications.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Inc. has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: SideChannel, Inc.

ticker: SDCH


text: The Company, as a part of its program has a documented cybersecurity incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for a potential disruption in technology we rely on. The Company is a member of cybersecurity intelligence and risk sharing organizations. Employees undergo security awareness training.

companyName: KELLANOVA


text: As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company's network environment. The attack temporarily affected operations and caused delays in execution of sales transactions at some locations. In addition, the Company incurred financial costs to investigate and remediate the incident, some of which was mitigated by insurance. During the incident, the attackers accessed and exfiltrated Company data, including some personally identifying information of certain Company employees. The Company contained the incident, notified affected individuals, and restored operations. The Company put in place remediation measures designed to help prevent future similar attacks and implemented certain other enhancements to its security system.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: Our CISO and other senior members of information technology personnel regularly report to the audit committee and the board of directors on recent trends in cyber risks and review our strategy to defend our business systems and information against cyber-attacks. From time to time, outside advisors may be invited to brief the audit committee on the current cybersecurity threat landscape and other related topics.

companyName: Invitation Homes Inc.

ticker: INVH


text: Our Chief Executive Officer, General Counsel and Chief Accounting Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Our cybersecurity program seeks to identify, assess and monitor material cybersecurity and other information technology risks and threats that may affect our information systems, networks and operations, including those systems and networks managed by third parties. We regularly assess potential risks and execute a layered cybersecurity strategy based on prevention, detection, mitigation, and remediation. The Company's cybersecurity risks are evaluated at least annually through our enterprise risk management program, which is a company-wide effort to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.

companyName: GRACO INC

ticker: GGG


text: Security Operations utilizes security solutions to detect and respond to security threats and supports the end-user security needs. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Our CISO has over three decades of relevant experience across the information technology landscape. His work experience has included managing cybersecurity risks at large multinational companies. Reporting to our CISO and leading a team of security engineers is our Vice President, Enterprise Security, who also has decades of experience architecting and deploying secure network, system, and data center infrastructure as well as designing and deploying processes and technology platforms that are designed to protect the enterprise from cybersecurity threats. In addition to board oversight and the presence of a cybersecurity team, we provide all applicable employees and contractors with cybersecurity awareness training and testing on an annual basis. We also deploy phishing exercises to all applicable employees and select contractors, as well as targeted phishing training to select employees and contractors, on a quarterly basis. Our product development teams keep current through specialized training on secure development practices for firmware, software, and hardware. Our training programs are designed to educate our employees on current cybersecurity risks and the programs we have in place that are designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee of the Board of Directors when appropriate.

companyName: ACUITY INC. (DE)

ticker: AYI


text: As of the date of this report, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Although the Company has mature processes in place to identify and mitigate potential risks from cybersecurity threats, such risks cannot be completely eliminated. More information on the risks of cybersecurity threats and potential impact to the Company can be found in Item 1A. Risk Factors.

companyName: DOW INC.

ticker: DOW


text: The company has an ERM program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the company's broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the company's operations, financial condition, and reputation in an ever-evolving threat landscape.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: We view cybersecurity as a shared responsibility across the Company. All employees are required to complete yearly security training, and we periodically perform tabletop exercises with management participation. Further, our cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection tools and a vulnerability identification program.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: Risk Management and Strategy company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties.

companyName: CO2 Energy Transition Corp.

ticker: NOEM


text: On an annual basis, the Information Security team reviews and updates its governance documents, including the Information Security Charter, the Information Security Policy, and the Information Security Program Plan, and then presents the revised documents to the Audit & Risk Committee for review and/or approval. Additionally, the Information Security team maintains a formal cybersecurity strategic three-year plan, which outlines the strategic vision and associated goals for the cybersecurity of our global operations. The plan is regularly updated with new initiatives that align with technology innovations and changes in the threat landscape, and is reviewed and approved by the CISO and the Audit & Risk Committee. Throughout the three-year plan term, the CISO regularly provides management with progress reports.

companyName: NASDAQ, INC.

ticker: NDAQ


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are included in our overall risk management program and designed to protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Cybersecurity risks are also periodically reevaluated in additional detail based on our experience and on external information regarding emerging risks. To protect our information systems from cybersecurity threats, we use various security tools, tracking procedures and investigational procedures to identify, investigate, and resolve potential security incidents in a timely manner. We also engage third-party vendors to assist with security management, incident detection and response.

companyName: Mural Oncology plc


text: Synovus' business depends on the availability, reliability, confidentiality, and security of our information systems, networks, and data. Any disruption, compromise, or breach of our systems or data due to a cybersecurity incident or threat could have a material adverse effect on our business strategy, financial condition, or results of operation. While the Company has experienced, and will continue to experience, cyber incidents in the normal course of business, to date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, financial condition, or results of operation. Despite our efforts to continually enhance our cybersecurity program, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, financial condition, or results of operation. See "Part I - Item 1A. Risk Factors – Operational Risk" of this Report.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Risk assessments: Our security team, in coordination with our enterprise risk management team, conducts periodic risk assessments to identify and analyze the business and security risks, vulnerabilities, emerging technologies, laws and regulations. An internal audit team evaluates the results of these risk assessments to determine critical areas for review as part of our annual internal audit plan. The results of the internal audit plan are reported to the audit committee, and the security team manages and maintains remediation strategies for identified risks.

companyName: HUBSPOT INC

ticker: HUBS


text: Email Banner for external emails. This banner assists us to identify any phishing / impersonation email and cannot be bypassed. Conditional Access Policy (CAP): Rejects connections to Exchange Online from un-authorized countries.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS) and other applicable industry standards and are integrated into our overall risk management system and processes. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Intrusions into our computer systems could result in compromise of confidential information."

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: Our comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats. This program is an integral component of our enterprise risk management program.

companyName: Cigna Group

ticker: CI


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical information technology and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and customer and employee data ("Information Systems and Data").

companyName: Sweetgreen, Inc.

ticker: SG


text: Our information technology (IT) team leads the Company's overall cybersecurity efforts and is responsible for the day-to-day management of risks we face, while our Board of Directors/management provides guidance on the oversight of risk management. Our Information Security Incident Response Plan is designed to escalate cybersecurity incidents, depending on the circumstances, to appropriate stakeholders as defined by internal Standard Operating Procedures. As part of such process, the corporate IT Security Team receives aggregate monthly reports from a third-party managed services organization contracted to monitor the TGTX IT environment. Additionally, the Vice President of IT receives regular reports from the corporate IT Security Team concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. Significant events are reported to the Chief Financial Officer.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: Risks from Threats and Incidents Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2023, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: We provide cybersecurity and information security compliance training to relevant employees at least once per year, tracking completion and requiring testing, and conduct simulated phishing campaign tests. We also provide additional specialized training for our security team and for employees with access to certain sensitive information.

companyName: SANMINA CORP

ticker: SANM


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: LA-Z-BOY INC

ticker: LZB


text: Our Vice President, IT Security is an experienced cybersecurity professional with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams, and holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.


text: Management is responsible for day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the Company has a management ERC, which comprises senior leaders of the Company, including the CEO, CFO, CLO, CSO, Vice President of Risk and Audit, and CBO, among others, and reviews on at least a quarterly basis risks that are escalated by the Company's ERM function, including cybersecurity risks. ERM maintains a risk taxonomy and a scoring methodology design to ensure risks are elevated in a clear and transparent manner, and further escalates top risks to the Safety Committee, along with planned mitigants and monitoring procedures.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Management is responsible for assessing and managing material risks from cybersecurity threats with leadership from the Company's Vice President – Chief Digital and Information Officer (CDIO), who is responsible for the Company's global Digital, Information Technology and Cyber Security organization. Our CDIO has served in various roles in information technology and information security for over 18 years with Fortune 500 companies. Our CDIO holds Bachelor of Science and Master of Science degrees in Computer Engineering. He has also completed other advanced leadership training and coursework regarding cybersecurity risk management. Our CDIO reports directly to the Chief Executive Officer.

companyName: Parker-Hannifin Corp

ticker: PH


text: Within CDRM, our Cybersecurity Defense Center ("CDC") has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If we experience a cybersecurity incident, the CDC activates our incident response plan, which includes processes to enable us to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Additionally, we have established a Cyber Crisis Management Team, which is responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the CDC continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: We integrate technology into many aspects of our business. We use technology to engage with our customers and employees, and to deliver our products and services. The business information and data managed and stored in our technology systems is used in many of our daily functions, including accounting processes, financial forecasting, pricing, underwriting, sales, compliance, and communications, among others. We are mindful of the risk in the operation of our business presented by cybersecurity threats and remain aware of the potential risk to our IT systems and data.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: Our Board oversees our Information Security Program and cybersecurity risks, this includes receiving periodic management reports on cybersecurity and information security trends and regulatory updates, technology risks, and the implications for our business strategy.

companyName: Rocket Companies, Inc.

ticker: RKT


text: Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology ("IT")

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Spok's enterprise risk management program includes our cybersecurity risk management program ("Cybersecurity Program"), which is designed to protect the confidentiality, integrity and availability of our critical systems and information. Our Cybersecurity Program is designed utilizing guidance from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and includes security policies and procedures, security appliances and software, third-party vulnerability testing, business continuity plans, and other administrative, physical and technical measures. Executive management, including our Chief Information Officer (CIO)/Chief Information Security Officer (CISO) and VP Technology Operations, has overall responsibility for assessing and managing key cybersecurity risks; implementation of the Cybersecurity Program is led by key information technology and security management members, including the CIO/CISO and VP Technology Operations, who have specialized training, and various certifications in information technology and cybersecurity strategy, tools and governance. The CIO/CISO has over two decades of experience directing security programs, controls, policies and operationalizing them specific to the healthcare industry. The VP Technology Operations has over a decade of experience managing the Cybersecurity Program, SOC2 audits and security controls and policies. As part of the enterprise risk management program, our Cybersecurity Program shares similar methodologies, reporting channels and governance processes to other areas across the Company.

companyName: Spok Holdings, Inc

ticker: SPOK


text: In the event of any breach or cybersecurity incident, we have a cross-functional incident response plan that includes an executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of cybersecurity risks deemed to have a moderate or higher business impact, even if immaterial to us, and identifies what is needed to restore normal operations efficiently.

companyName: CSI Compressco LP


text: Deutsche Bank's Chief Security Officer has served in various roles in information security for more than 20 years. This includes the role as global Chief Information Security Officer ("CISO") / Chief Security Officer ("CSO") for three different large European financial institutions and a partner position in a global strategy and consulting firm, leading security work for financial service clients. The Chief Security Officer is supported by information security role holders at various seniority levels to help ensure that security requirements are met from a regional, divisional, and technical perspective.

companyName: RREEF Property Trust, Inc.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CITO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CITO and CISO have one and 20 years of experience in cybersecurity, respectively. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.

companyName: Concentra Group Holdings Parent, Inc.

ticker: CON


text: The KKR CISO chairs the technology and information security risk committee for KKR's asset management business, which consists of employees from the firm's technology group and other groups, including risk, legal and compliance. The technology and information security risk committee is responsible for overseeing the cybersecurity risk environment for KKR's asset management business, which includes identifying and monitoring KKR's technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at the firm. The technology and information security risk committee reports to KKR's risk and operations committee, which consists of senior level employees of KKR who focus on KKR's overall operations and enterprise risk management, including the Chief Operating Officer, Chief Compliance Officer, Chief Legal Officer and Chief Financial Officer. Periodically, including at least annually and more often as circumstances may require, management will present to the Audit Committee and the Risk Committee of our Board of Directors on various topics relating to KKR's technology risks, including KKR's cybersecurity program (including the results of an annual cybersecurity table top exercise), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes, and geopolitical cyber threat management), and risk management (including the results of periodic technology audits).

companyName: KKR & Co. Inc.

ticker: KKR


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10 -K for discussion of risk factors.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Before purchasing third-party technology or other solutions that involve exposure to our assets and electronic information, our Information Technology Team performs a review on vendors (evaluating suitability, risk, and impact) before they are approved to work with us.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. We depend on various controls, policies, procedures and programs ("Risk Controls") to manage our risks, including risks associated with our information systems. Risks Assessment and Risk Controls are included as part of our annual enterprise risk management ("ERM") program. Our risk controls include our administrative, physical, and technical controls ("Cyber Risk Controls"). We are dependent on our Cyber Risk Controls to protect our information systems and the data that resides on or is transmitted through them. The Cyber Risk Controls are in many cases integrated with our other Risk Controls in an attempt to maximize their effectiveness.

companyName: Cactus, Inc.

ticker: WHD


text: The Audit Committee of our Board of Directors is responsible for oversight of the Company's programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee receives regular briefings on cybersecurity matters from the CIO, including updates on material risks, cyber incidents, cyber program maturity, and ongoing improvements. The CIO prepares regular updates on Cybersecurity, which are integrated into the Board of Directors' broader oversight of enterprise risk management, and any material cyber risk is treated as part of overall business and risk management strategy.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scans and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the IT and IS Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT and NIST CSF to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.

companyName: LAKE SHORE BANCORP, INC.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer, as well as our Director of IT. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: MoonLake Immunotherapeutics

ticker: MLTX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems. These include password requirements, onboarding and termination processes, and other access controls. We also use third-party service providers to assist in assessing our controls and security systems that identify and prevent malicious activity or unauthorized access on an ongoing basis such as firewalls and email security, operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. We currently do not have any formal processes to oversee or identify cybersecurity risks associated with third-party service providers but our management generally evaluates such are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: Strategic Environmental & Energy Resources, Inc.

ticker: SENR


text: The Audit Committee actively participates in discussions with management regarding cybersecurity risks. The Audit Committee performs an annual assessment of the Company's cybersecurity program, which includes a discussion of management's actions to identify and detect threats, and scenarios for potential response or recovery situations. In addition to regularly scheduled meetings, the Audit Committee and appropriate levels of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Company engages a third-party provider to maintain our systems and management participates in the assessment to identify any risks from cybersecurity threats. Our third-party provider monitors our firewall, network, system security and internal and external backups and reports any issues to the Company. The Company's Board, together with management, is engaged in our cybersecurity monitoring managed by our third-party provider and it is constantly changing. Any issues are appropriately addressed timely. To date, we have not experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: Brownie's Marine Group, Inc

ticker: BWMG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, information related to our clinical trials, and information of our employees, or Information Systems and Data.

companyName: Landos Biopharma, Inc.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs.

companyName: Cerevel Therapeutics Holdings, Inc.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve and recover from security incidents in a timely manner. Our Board of Directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the by the Risk Management Committee of the Board of Directors. Our Data Breach Response Team performs annual cybersecurity tabletop incident response exercises, pursuant to our Data Breach Response Policy and Plan. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants and other external cybersecurity experts to assist in the identification, verification and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. See our risk factor "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed" in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats. Our risk management strategy and governance framework is designed to identify, assess and manage material risks from cybersecurity threats to our systems, networks, and data infrastructure, including intellectual property, customer data, and data that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Stitch Fix, Inc.

ticker: SFIX


text: We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process. These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor SOC 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.

companyName: KELLY SERVICES INC

ticker: KELYA


text: As part of our cybersecurity risk management strategy, we periodically engage with assessors, consultants and other third-parties to evaluate and test our systems. We also engage an independent Qualified Security Assessor to review our Payment Card Industry compliance.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our management team, including the Senior Vice President of Information Technology & Security and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a Senior Vice President of Information Technology & Security with 20 years of experience in information technology and a General Counsel with 11 years of cybersecurity oversight responsibilities.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: Our Chief Financial Officer oversees our CSIRT, whose members have years of experience working in cybersecurity and certifications including CISSP (Certified Information Systems Security Professional), CCSP (Certified Cloud Security Professional), CGRC (Certification in Governance of Enterprise IT), GIAC (Global Information Assurance Certification) and GCED (GIAC Certified Enterprise Defender). Our CSIRT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.

companyName: SIMON PROPERTY GROUP L P


text: In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats, although there can be no assurance, that our cybersecurity program will prevent all incidents.

companyName: IGC Pharma, Inc.

ticker: IGC


text: Our President is responsible for assessing, identifying and managing risks to us from cybersecurity threats. Under his direction, we have contracted with a third-party IT and cybersecurity consultant that monitors our IT systems and firewall protections, as well as those of Matilda Stream Management, which provides offices and administrative services to us.

companyName: CKX LANDS, INC.

ticker: CKX


text: We maintain cyber event related insurance but we have also instituted an information security structure and process to assess, identify, manage, and, if necessary, report cybersecurity risks. We maintain a cybersecurity incident response process and a tracking system for any incidents in an effort to ensure appropriate actions are taken. Any member of the Company can report a suspected incident and it will be investigated.

companyName: DHI GROUP, INC.

ticker: DHX


text: Risk Identification The Company's Chief Information Security Officer ("CISO") and Cybersecurity team are actively engaged within the cybersecurity community in order to monitor emerging trends and developments and share best practices for identifying and mitigating cyber threats. For example, the Company participates in threat intelligence information-sharing networks, such as the Financial Services Information Sharing and Analysis Center (FS-ISAC). The Company also tracks industry and government intelligence sources for information about evolving cyber threats and deploys updates to its systems, as appropriate. The Company's Cybersecurity team monitors and investigates suspicious events.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: We engage third party security experts to supplement our internal CWG team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts provide guidance to support our cybersecurity efforts. We use the findings of these third-party experts to improve our practices, procedures, and technologies. We also engage as necessary third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, cyberattacks, or deficiencies, which could materially affect our results."

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: To the extent cybersecurity risks are identified, they are responded to by our cybersecurity team. Cybersecurity incidents are managed, evaluated, investigated, and responded to in accordance with our documented Cyber Incident Response Plan.

companyName: AZEK Co Inc.


text: Although ACNB has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that ACNB will not experience such an incident in the future or the potential impact thereof. For additional information regarding the risk ACNB faces from cybersecurity threats, please see the risk factors titled "ACNB's operations of its business, including its transactions with customers, are increasingly done electronically, and this has increased its risks related to cybersecurity". and "ACNB's communications, information, and technology systems may experience a failure, interruption or breach in security". included in Part I. Item 1A. — Risk Factors of this report.

companyName: ACNB CORP

ticker: ACNB


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework issued by the National Institute of Standards and Technology Framework, an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO"), that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.

companyName: LINDSAY CORP

ticker: LNN


text: Our cybersecurity risk management efforts leverage the National Institute of Standards and Technology (NIST) cybersecurity framework, that also directly conforms to the SP800-53 r5 Information Security controls framework. Our cybersecurity personnel identify and assess risks using various methods and security tools designed to help prevent, identify, protect, detect, escalate, respond, and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: INTELLINETICS, INC.

ticker: INLX


text: Role of Management Dow's Information Systems organization led by Dow's Chief Information and Digital Officer, is responsible for administration of the cybersecurity and information security framework and risk management, with oversight by the Audit Committee.

companyName: DOW INC.

ticker: DOW


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board administers the risk oversight function directly through the Board, as well as through various standing committees of our Board that address risks inherent in their respective areas of oversight. The Board at least annually reviews management's annual enterprise risk assessment, business continuity process and cybersecurity posture. Our Audit Committee is responsible for overseeing the management of risks associated with our financial reporting, accounting and auditing matters, as well as business-related risks (such as leadership, continuity, cybersecurity and matters relating to our commercial activities), reviewing as required our processes around the management and monitoring of such risks, as well as conducting a risk assessment review. Our Audit Committee charter sets forth the responsibilities of the Audit Committee consistent with applicable SEC and Nasdaq rules, including reviewing our approach to risk mitigation with respect to IT and cybersecurity. An information security update is provided quarterly, or as needed, to the Audit Committee, with a detailed review provided at least annually, or as needed.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: The Program is overseen by the Company's Board of Directors through its Audit Committee which, pursuant to its charter, assists the Board with oversight of Company privacy, data security, and cybersecurity matters and risks. The Audit Committee meets regularly with the Company's executive management, including the CISO and the Chief Information Officer, and receives updates on the status and overall effectiveness of the Program, changes to the Program, relevant information technology operations, any changes in material cybersecurity risks and any significant cybersecurity incidents consistent with the IRP. The Audit Committee also discusses with executive management the steps management has taken to monitor and mitigate privacy, data security, and cybersecurity risk exposures, the Company's information governance policies and programs, and major legislative and regulatory developments that could materially impact the Company's exposure regarding privacy, data security risk, and cybersecurity. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: We believe in a proactive approach to enterprise risk management. A major tenet of our cybersecurity program includes training to educate and inform team members on cyber hygiene and threat management as well as regular testing to check for understanding. We have invested in technology and dedicated internal resources to facilitate training for application developers, conduct tabletop exercises, run anti-phishing campaigns, and train on privacy regulations. These training activities, along with other key risk indicators, are tracked and reported to our Enterprise Risk Committee on a quarterly basis.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: The Information Security Committee ("ISC") is chaired by the CISO and is responsible for overseeing cybersecurity risk, including information security policies and procedures, information security audits, social engineering testing, vulnerability management, penetration testing, information security projects, business continuity, incident response planning, and current threats and security advisories related to the bank's information systems and data assets. The ISC members include the CRO, Chief Information Officer, and General Counsel, with broader attendance from representatives of Risk Management, Technology, Operations, Internal Audit, and Retail. The ISC, in turn, provides a summary update and points of escalation to the Risk Management Committee ("RMC"), who is chaired by the CRO.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company also engages third-party providers to conduct periodic internal and external penetration testing and maturity assessments. The Company stores data on premise and in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Ecovyst Inc.

ticker: ECVT


text: The Company maintains an incident plan that addresses the Company's response to a cybersecurity event, which is periodically reviewed and updated.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A.–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."

companyName: Franklin BSP Capital Corp

ticker: FRBP