text: Cybersecurity Governance Cybersecurity, as an important part of the Company's risk management processes, is a critical area of focus for the Company's Board of Directors (the "Board"), which is responsible for oversight of the Company's cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols. As part of the Board's oversight, the Board receives a report at least annually from the Company's Vice President of Information Technology and other members of the Company's executive management team. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the cybersecurity program, and the emerging threat landscape.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: e. Cybersecurity awareness training of our employees, and senior management; and f. A third-party risk management process for service providers, suppliers and vendors.

companyName: Douglas Emmett Inc

ticker: DEI

secItem: Item 1C


text: Key components of our cybersecurity program include: • an enterprise organizational framework that consists of enterprise leaders that oversee our cybersecurity governance, including policies and standards, and functional business unit leaders that implement our cybersecurity policies; • the identification of our cybersecurity risks and vulnerabilities and the implementation of protections against cybersecurity threats and incidents, including regular training to our employees; • continual global threat monitoring and detection, in partnership with third-party service providers; • a process for assessing the severity of cybersecurity threats, identifying whether the cybersecurity threats are associated with a third-party service provider, and implementing an appropriate response and resolution to cybersecurity incidents, as necessary; and • risk-based cybersecurity audits led by our internal audit function, which include cybersecurity control maturity assessments (based on NIST CSF), as well as attack simulations and penetration testing performed by third-party service providers.

companyName: MASCO CORP /DE/

ticker: MAS


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our IT management team, internal security staff, or external experts as part of the Board's continuing education. Seven members of our Board have information security expertise, including Joseph C. Beery, Lewis Chew, Gary S. Guthart, Ph. D., Amal M. Johnson, Sreelakshmi Kolli, Keith R. Leonard, Jr., and Mark J. Rubash.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: In addition, we use third party service providers to perform a variety of functions throughout our business. As a result of such use of third party service providers, we face additional cybersecurity-related risks. We have a vendor management program designed to help us manage cybersecurity risks associated with our use of third party service providers. We maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third party service providers. Third party service providers that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies or where the Company's anticipated use of such third party service providers may result, for example, in the provider's access or processing of certain Company information or data, are evaluated to assess their performance across several domains, including data security, operations management, and privacy. We seek to maintain effective communication with our third party service providers to facilitate timely notification of cybersecurity incidents that might impact the Company.

companyName: Akili, Inc.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".

companyName: MEDICINOVA INC

ticker: MNOV


text: Our cybersecurity risk exposure primarily involves the protection of source code, confidential development data, and corporate information stored in cloud-based collaboration and hosting environments. We have implemented cybersecurity risk management practices that are appropriate for our current size, resources, and operational complexity. These practices include, among others: Utilizing reputable third-party hosting and version control providers that maintain recognized security certifications (e.g., ISO 27001, SOC 2); multi-factor authentication for company accounts and administrative access;

companyName: SafeSpace Global Corp

ticker: SSGC


text: Adrian J. Holt, age 54, is Senior Vice President and Chief Human Resources Officer. Mr. Holt is responsible for human resources strategy and services worldwide, which includes inclusion and diversity, total rewards, learning and leadership development, and global talent acquisition and management. Mr. Holt joined Eastman in 2016 as Vice President, Global Talent Acquisition and HR Client Support, Americas and EMEA. Prior to Eastman, Mr. Holt served as Chief Human Resources Officer for WireCo World Group and as Vice President of Corporate Human Resources for BASF North America. Mr. Holt was appointed to his current position effective May 2023.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer. The CISO receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. The CISO works closely with our Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and to develop reports and presentations to the board of directors and its audit committee. The CISO is responsible for providing training to employees in respect of information security.

companyName: StepStone Group Inc.

ticker: STEP


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there are any. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Ribbon Acquisition Corp.

ticker: RIBB


text: This is a fluid situation and management and the board of directors intends to meet periodically to assess the adequacy of the then-current status and determine if any additional steps are indicated.

companyName: WORLDS INC

ticker: WDDD


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage cyber risks. The program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. We continually evaluate the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. iBio acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: iBio, Inc.

ticker: IBIO


text: The Company's enterprise threat and vulnerability identification and detection capabilities operate on an ongoing basis, with results reported weekly. The capabilities utilize endpoint sensors and network scanning to meet and maintain leading bad actor tactics and techniques, including machine learning and artificial intelligence, to protect against potential malicious threats or other potentially unwanted programs or identity abuse, including privilege escalation or abuse of least privilege access enforced by the Company.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We have implemented cybersecurity tools, conducted employee training, and monitored emerging laws and regulations related to data protection and information security. We may a lso obligate certa in third -party business partners to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect the Company.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: In addition, we maintain a detailed Incident Response Plan to assist in responding to potential cybersecurity threats. Our Incident Response Plan addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies to prevent future incidents. Our Information Security and Privacy Teams conduct tabletop exercises twice per year to ensure preparedness for information security, including cybersecurity incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing and social engineering simulations. We also maintain cybersecurity insurance coverage.

companyName: Tempus AI, Inc.

ticker: TEM


text: Cybersecurity risk is an important component of our overall enterprise risk management framework, given our reliance on digital systems for product development, operational control, communications, data management, and financial reporting. Our operations involve proprietary software and hardware systems integrated into offshore platforms, as well as sensitive information related to customer deployments, government employ a layered cybersecurity approach aligned with industry standards. Our strategy includes preventive and detective technical controls (e.g., endpoint protection, intrusion detection, access control, and network segmentation), employee training, vendor diligence, and third-party audits. We maintain a combination of on-premise and cloud-based infrastructure with multi-factor authentication and routine patch management.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: Our executives and IT management and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity. In addition, our executives and IT management and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.

companyName: MAXLINEAR, INC

ticker: MXL


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and business continuity plan; vulnerability management policy; risk assessments; implementing certain certifications and security standards; encrypting certain of our data; network security controls; segregating certain data; access and physical security controls; asset management, tracking, and disposal; monitoring our systems; employee training; penetration tests; maintaining cybersecurity insurance; and dedicated cybersecurity staff.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program. is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: Cybersecurity incident response procedures are informed by NIST Special Publication 800-61, and continuously improved following quarterly exercises and live incidents. Incident response emphasizes rapid containment following detection of a range of threats including: • repeated login failures; • suspicious network traffic; • malware detection; and, • other threats as prioritized through a combination of industry threat intelligence via the Healthcare Information Sharing and Analysis Center and the Company's security operation center.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: As our business objectives and operational needs change, our cybersecurity professionals continuously evaluate and refine the measures taken to address our identified risks. Our technical measures include firewalls, intrusion detection and prevention systems, anti-malware tools, and access and configuration controls, to shield our information systems from cybersecurity incidents.

companyName: ARGAN INC

ticker: AGX


text: We are subject to various legal and regulatory requirements related to cybersecurity. Compliance with these requirements is of utmost importance to management, is a top priority for the Company and is a shared responsibility among all stakeholders. Throughout the reporting period, we have diligently worked to ensure our compliance efforts align with these obligations, and we are committed to ongoing efforts to enhance our cybersecurity measures and stay vigilant against evolving threats.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: On a regular basis, our Vice President of Corporate Development & Administration will report to our board of directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows, reputation and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Our Board has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Accounting Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to the Audit Committee, which consists of 100% independent directors, and ultimately to our Board. Management presents an assessment of our cybersecurity processes, procedures, and results of testing to the Audit Committee at least annually.

companyName: PHX MINERALS INC.


text: An integral component of Adtalem's Response Plan is our Privacy Incident Response Plan (the "Privacy Response Plan") which addresses privacy of our students' records, including under the Family Education Rights and Privacy Act of 1974. The Privacy Response Plan requires annual training for our employees on how to recognize and report potential privacy incidents.

companyName: Covista Inc.

ticker: CVSA


text: GoDaddy maintains an enterprise-wide cybersecurity program designed to manage risks to the company's information systems from cybersecurity threats and cybersecurity incidents.

companyName: GoDaddy Inc.

ticker: GDDY


text: periodic cybersecurity awareness training for both ship and shore personnel; and use of external cybersecurity vendors and threat detection and intelligence services to assist with incidence response and handling.

companyName: DORIAN LPG LTD.

ticker: LPG


text: Brunswick's cybersecurity risk management program is managed by a dedicated cybersecurity team. The team is led by the Chief Information Security Officer (CISO), who reports directly to the Chief Executive Officer (CEO) and the Chief Information Officer (CIO), and has over 20 years of experience in information security, cybersecurity, and IT risk management. Brunswick's CISO holds a BBA, majoring in Accounting and Management Information Systems, and an MBA in Strategy and General Management. The CISO is supported by a leadership team with backgrounds in cybersecurity, risk management, and other related capabilities.

companyName: BRUNSWICK CORP

ticker: BC


text: Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board of Directors, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clearwater Paper Corp

ticker: CLW


text: For a description of the risks from cybersecurity threats that may materially affect the company and how those risks may affect the company, please refer to Part I, Item 1A. Risk Factors—Risks Related to our Intellectual Property and Technology of this Annual Report on Form 10-K for additional information about cybersecurity-related risks.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The board and its committees engage with management to discuss potential enterprise risks, including matters related to cybersecurity.

companyName: Wright Investors Service Holdings, Inc.

ticker: IWSH


text: Our enterprise information security program, which is designed to ensure that our information systems are adequately protected, is based on frameworks established by the National Institute of Standards and Technology and other applicable industry standards. We consider our enterprise information security program to be a key component of our overall risk management system, with program elements evaluated annually and briefings provided to management each quarter.

companyName: MKS INC

ticker: MKSI


text: The Cybersecurity Oversight Team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our Compliance and Risk Management Committee when appropriate.

companyName: Augmedix, Inc.


text: Our Cybersecurity Steering Committee, which includes the Vice President of Cybersecurity and several members of management, is responsible for the oversight of our cybersecurity program. The Vice President of Cybersecurity has over 20 years of experience in cybersecurity. Members of this committee include our General Counsel, Chief Financial Officer and the Senior Director of Internal Audit and Risk Management, all of whom have significant experience in managing enterprise risk, including risk from cybersecurity threats. The Cybersecurity Steering Committee meets routinely to discuss the status of the cybersecurity program, the status of responses to cybersecurity incidents or threats, any updates on certification programs and any emerging cybersecurity threats. Information received by management through the Cybersecurity Steering Committee is regularly included in the quarterly updates to the Audit Committee.

companyName: ANSYS INC


text: At its core, our cybersecurity program is the collection of people, processes and technologies that are designed to protect our networks, computers and data from attack, damage, or unauthorized access. The cybersecurity program is also part of a broader cybersecurity framework, which involves how we assess and manage cybersecurity threat risks and how this integrates into our overall risk management framework. While the foregoing summary is specific to our North America business operations we believe that the cybersecurity programs of our International business operations are consistent with the approach and framework outlined below and are appropriate for the scope and scale of their operations.

companyName: Zumiez Inc

ticker: ZUMZ


text: Management's Vigilance A Security Council, led by the CISO with representatives from our engineering, corporate IT, security, legal, human resources, and internal audit teams, diligently reviews and assesses cybersecurity plans, risks, and incidents on a monthly basis. Any substantial risk incident is escalated to the executive team, disclosure committee, and potentially the full Board, if deemed material. Regular communication between the CISO and the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer ensures top management is well-informed about NerdWallet's cybersecurity posture and potential risks.

companyName: NERDWALLET, INC.

ticker: NRDS


text: We have experienced various types of cyber-attack incidents which, to date, have been contained and did not have a material impact on our business strategy, results of operations or financial condition. As a result of such incidents, we continue to implement new controls, governance, technical protections, and other procedures to mitigate and prevent future incidents. We have a cybersecurity committee that is composed of our Executive Vice President of Technology, our Director of Information Technology and our General Counsel. The committee meets quarterly to review any incidents and incident responses and reports its findings to the President and Chief Financial Officer. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or our vendors or suppliers fall victim to other successful cyber-attacks.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: The SVP-CFO, VP-Controller and VP-General Counsel are explicitly informed by the Director of Information Systems, internal security team and Managed Security Service Provider (MSSP) of incidents and periodically updated on the investigation progress and impact of the incident. Management also receives explicit monthly summaries on all incidents. Material incidents are summarized at an annual management review meeting.

companyName: BADGER METER INC

ticker: BMI


text: In addition, the Audit and Technology Committees of the Board coordinate on risk management oversight with respect to cybersecurity, including through quarterly joint meetings that cover the following topics: • Regular reports from the internal audit department regarding the security and technology portions of the internal audit plan • Regular reports from our CISO and Chief Technology Officer regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items • Regular reports from our Chief Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, including matters related to cybersecurity The Technology Committee of the Board oversees our information security program, including: • Reviewing with management our technology investments and infrastructure associated with risk management, including policies relating to information security, disaster recovery and business continuity • Receiving quarterly reports directly from our CISO, including updates on our enterprise cybersecurity threat level • Overseeing the engagement of outside advisors to review our cybersecurity program • Reviewing the results of our annual information security program maturity assessment performed by a third party • Reviewing the results of our annual security program risk assessment prepared by management Management Oversight of Cybersecurity Risk Our information security program is managed through implementation, monitoring and continuous improvement of the security program with active participation of management as described below. • Senior Leadership Team. The Equifax senior leadership team, consisting of our CEO and his direct reports ("SLT"), sets the tone for strategic growth, effective operations and risk mitigation at the management level. The SLT supports the management of the information security program through proper resource allocation and decision-making involving high risk issues. The SLT has overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax. • Chief Information Security Officer. Equifax has a CISO who is a member of the SLT and reports directly to our CEO. Our CISO has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies. Our CISO is responsible for the assessment and management of material risks from cybersecurity threats, including oversight of the global Security team and the implementation and execution of the information security program. Our CISO helps ensure that the program is strategically aligned to Equifax's business strategy and is responsible for reporting on the effectiveness of the program to the SLT and the Board of Directors. • Global Security Team. The Equifax global Security team is responsible for supporting the CISO in the execution of the information security program to meet the program's objectives. The Security team is directly responsible for the day to day program activities such as planning, implementation, monitoring and reporting on operational capabilities.

companyName: EQUIFAX INC

ticker: EFX


text: We have established a supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to assess and evolve our oversight processes to mature how we manage cybersecurity risks associated with the products and services we procure. We generally require our suppliers to adopt security practices based on industry-recognized standards.

companyName: TRIUMPH GROUP INC


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our management actively oversees our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. We have established and maintain a Cybersecurity Maturity Model Certification ("CMMC") compliance program and are working to meet all applicable deadlines. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: GRESHAM WORLDWIDE, INC.


text: We have implemented and maintain various information security risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our information assets and mitigate harm to our business.

companyName: Cardlytics, Inc.

ticker: CDLX


text: Innventure is in the process of implementing measures to mitigate potential risks associated with information technology disruptions and cybersecurity threats, and Innventure plans to periodically assesses these risks, implements controls, and performs business continuity and disaster recovery planning. Innventure's current risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of cybersecurity technologies. These measures are designed to help protect Innventure's proprietary systems and customer data from both internal and external cybersecurity threats.

companyName: Innventure, Inc.

ticker: INV


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably Address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. The primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Executive Officer will employ the expertise of an IT consultant in the event that risk management assessment warrants.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: Recognizing the complexity and evolving nature of cybersecurity threats, SandRidge engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes focus on industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: Our Chief Information Security Officer meets regularly with our information technology teams as well as other members of management to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.

companyName: AbbVie Inc.

ticker: ABBV


text: Managing Material Risks and Integrated Overall Risk Management The Company has implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is designed to align with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, third-party conducted penetration tests and network monitoring. We also provide security awareness training for employees and contractors, maintain a cybersecurity insurance policy and invest in new security capabilities designed to address emerging threats.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: The head of our IT department, who has more than 25 years of experience in IT and more than 15 years of experience in cybersecurity for public companies, reports to our Chief Operating Officer and works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We have established an Incident Review Team, which consists of representatives of our Finance, IT and Legal departments, to investigate, evaluate and respond to cybersecurity incidents. The Incident Review Team is responsible for escalating confirmed cybersecurity incidents to a Materiality Assessment Team, consisting of members of management. The Materiality Assessment Team is responsible for reporting cybersecurity incidents to the audit committee of the board of directors, as appropriate based upon the nature of the incident (or series of incidents).

companyName: Kura Oncology, Inc.

ticker: KURA


text: We have integrated cybersecurity risk assessments into Bunge's overall enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. Our CRO formulates periodic reports and provides them to our Management Risk Committee ("MRC"). As noted in "Item 1. Business - Risk Management", the MRC reviews key enterprise risks on an ongoing basis and is responsible for reviewing and monitoring key exposures, emerging risks, and drivers of risk. Bunge uses a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize, and mitigate cybersecurity risks, which is periodically assessed by an independent third party.

companyName: Bunge Global SA

ticker: BG


text: Our Director of Information Technology and our Manager of IT Security, having a combined 45 years of information technology experience1 take the lead in protecting the organization's digital assets and sensitive information from cyber threats and manage our partnerships with the external firm that specializes in around-the-clock threat monitoring, detection, and response services and other third-party providers.

companyName: Rayonier, L.P.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor's written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our information security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through a variety of means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. We also augment our internal cybersecurity expertise by engaging security service organizations which provide 24x7 security operations centers.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years, and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the Fund.

companyName: Fidelity Private Credit Fund


text: Management provides quarterly reports on our cybersecurity risks to the Committee. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Our management team, including our Chief Technology Officer and Chief Information Security Officer (CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer, the Company's co-founder and former CEO, has extensive experience in computer science and technology, including as a visiting scholar at Stanford University. This experience has enhanced his expertise in cybersecurity governance and risk management. Our CISO is a Certified Information Systems Security Professional and his experience includes over 20 years of working in the cybersecurity field in various industries, including data analytics, identity verification software, and financial services industries, and 15 years leading teams and programs.

companyName: Oscar Health, Inc.

ticker: OSCR


text: Third Party Service Provider Risk Management Our third-party risk management process is designed to identify, assess, and mitigate risks associated with third-party service providers, including cybersecurity risks. An initial assessment is conducted to assess the cybersecurity risks associated with a third-party provider based on various criteria, such as whether the third-party provider has access to our network, data, and information systems. Third-party providers that are identified through the initial assessment as warranting further review are subject to additional risk assessment. In parallel, we have designed a contracting process to mitigate cybersecurity risks by specifying the rights and responsibilities of the parties.

companyName: CONOCOPHILLIPS

ticker: COP


text: The ICP incorporates formal policies and procedures to ensure established controls are subjected to testing and independent effective challenge, to provide for appropriate due diligence and ongoing oversight of third parties who have access to our confidential information and/or systems, and to provide information and cybersecurity training to our employee population to ensure awareness of risks facing the institution and latest techniques used by malicious actors. A key component of the training program is the performance of phishing and social engineering campaign, the result of which are used to gauge the training program's effectiveness, as well as to identify employees that pose a potential higher level of phishing/social engineering susceptibility risk, with all such employees provided additional targeted training. The ICP also includes subject matter expert review of third-party servicing agreements to ensure provisions adequately protect the bank in the event of a cybersecurity event whenever the relationship involves sensitive customer information. Internal auditors and third-party security experts are relied upon to review and ensure that established controls are appropriately designed, effectively implemented, and operating as intended; with such reviews undertaken as part of the Bank's internal audit and third-party penetration testing programs.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks. These leaders meet with the committees on a regular basis, at least four times per year, and provide dashboards or reports, which summarize cybersecurity risks and action plans.

companyName: CUMMINS INC

ticker: CMI


text: The Company has cybersecurity incident response policies and procedures for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. Our cybersecurity program is based on components of the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. The Company's Vice President, Information Security, who has 19 years of experience in information security, including 8 years as a Chief Information Security Officer ("CISO"), and holds a post-graduate degree in a related field of study and is a Certified Information Systems Security Professional ("CISSP"), is primarily responsible for managing and assessing cybersecurity risks.

companyName: GRAPHIC PACKAGING HOLDING CO

ticker: GPK


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our cybersecurity program maintains assessment protocols for proactively evaluating potential cybersecurity impacts and risks, supported by incident response procedures. We employ systematic processes to manage cybersecurity risks, including through cybersecurity audits, interconnectivity with business networks, system access controls and monitoring, and data back-up and recovery. Our cloud environments undergo continuous assessment, with firewall and backup systems designed to support operational resilience. We employ a Zero Trust Security framework that requires identity verification for network access, complemented by regular system assessments and monitoring. Our security controls include identity management programs, data loss prevention protocols, and threat detection capabilities. Our controls undergo regular review and updates based on threat intelligence, ensuring adaptability to merging threats. Similarly, our incident response program is regularly tested and updated to address emerging threat landscapes. To ensure organization-wide security awareness, cybersecurity training is mandatory and issued to all employees annually. Cybersecurity awareness is also included across other training programs, including our annual Code of Conduct and privacy training programs.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database ("Data Incident"). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: The Company deploys multiple tools and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, both internal and associated with the use of any third-party service provider.

companyName: QuantumScape Corp

ticker: QS


text: Cyber Risk Management and Strategy EastGroup incorporates cybersecurity processes, which include periodic tests of its information security processes and systems by external firms, into the Company's overall risk management program. EastGroup has processes and policies regarding incident response, identity and access management, employee training on cybersecurity matters, device management, and patch and vulnerability management, among others. We also maintain processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls ("SOC") reports provided by potential vendors. Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company's cybersecurity risks. The cyber consulting firms currently conduct testing of EastGroup's controls and environment, including penetration testing, to identify and remediate cybersecurity risks. They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including conducting phishing exercises with the Company's employees.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: ALPHA MODUS HOLDINGS, INC.

ticker: AMOD


text: We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives a briefing from management on our cyber risk management program at least annually.

companyName: SITIME Corp

ticker: SITM


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing and discussing with management our cybersecurity risk assessment and management processes, including our oversight and the steps we take to monitor and help control risks from cybersecurity threats.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our CIO and other members of the information security organization routinely engage with our CFO regarding cyber risk management activities and provide updates and data, as needed, to other members of our executive team to facilitate decisions regarding security matters. No less than twice per year, and more frequently as appropriate, our CFO and CIO also provide updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee of our Board of Directors, and provide other information as needed to facilitate the committee's oversight of our cybersecurity risk.

companyName: Freshpet, Inc.

ticker: FRPT


text: PGE has a management-level committee, the Integrated Security Executive Committee ( ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company's management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer, the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: The ISO provides our Board of Directors with periodic reports regarding the Company's cybersecurity condition, key activities and recommendations for improvement of the Information Security Program. The ISO coordinates any incident responses with members of the Company's executive management, regulators and third parties. The ISO also reports any matter relating to cybersecurity incident responses and control deficiencies to our Board of Directors and its Audit Committee, respectively.

companyName: Finwise Bancorp

ticker: FINW


text: The Company maintains a cybersecurity program that is designed to identify, detect, assess and manage cybersecurity risks. The Company's senior management and its Board are actively involved in the oversight of the Company's risk management program, of which cybersecurity is an important part. The Company's cybersecurity program, which aligns to the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework") includes, among other things: • regular internal and external penetration testing of our technology environments at the application, infrastructure and network level, covering the systems, products and practices collecting or storing confidential business and personal information— including user data—in accordance with the Company's security policies. This testing is conducted multiple times a year by third-party firms; • third-party provider security assessments to evaluate associated risks and appropriate internal and third-party provider security controls; • processes to manage security risks and vulnerabilities; • mandatory company-wide cybersecurity compliance and information handling training; • a documented cybersecurity incident response plan that establishes procedures, roles, responsibilities and communication protocols for internal staff and external resources in the event of a cybersecurity incident; • cybersecurity tools that assist with the automation and orchestration of security alert response based on the relative risk; and • threat intelligence sharing relationships with industry partners, peers, and government agencies, as needed and appropriate.

companyName: Fox Corp

ticker: FOXA


text: We maintain organizational safeguards that include employee training, business continuity planning and cybersecurity insurance. These safeguards are reviewed on an annual basis or more frequently as the business environment warrants and are adjusted as needed to account for changes in the Company and overall risk environment. Cybersecurity training is delivered to employees through a combination of online modules and, where role-specific needs or circumstances warrant, instructor-led classroom sessions. This approach ensures comprehensive training tailored to the requirements of various roles while maintaining flexibility and accessibility.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: We maintain an operational incident portal that allows employees to log instances where they believe they have been the victim of a cyber incident, encountered a data breach or have become aware that a third-party service provider has suffered a cyber incident or data breach. In respect of cyber incidents and data breaches, timely reporting helps to contain the breach, recover faster, minimize business impacts, and comply with laws and regulations including time sensitive notifications. Cyber security is considered everyone's responsibility, and it is important that incidents are reported quickly and efficiently.

companyName: Enstar Group LTD


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Chief Financial Officer oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.

companyName: DIH HOLDING US, INC.


text: In an effort to deter and detect cyber threats, we provide key employees, with various cybersecurity trainings that cover timely and relevant topics, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Our Board of Directors oversees risk management for the Company, including through its approval of the investment policy and other policies of the Company and its oversight of the Adviser. For certain risks, our Board of Directors has delegated oversight responsibilities to committees of our Board of Directors. For example, the Nominating and Corporate Governance Committee assists our Board of Directors with assessing risks associated with conflicts of interest. Cybersecurity risk management is integrated into this broader risk management framework. Our Board of Directors has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: We are committed to reducing the risk of cybersecurity compromise, either intentional or unintentional, to our customers, employees, and company proprietary information resources.

companyName: JABIL INC

ticker: JBL


text: Our cybersecurity risk management program is focused on the key areas below: • Governance. In fulfilling its oversight responsibility, our board of directors receives regular reports from our senior management team on our cybersecurity risks and exposures, infrastructure and countermeasures, and other monitoring, testing and recovery systems. • Collaborative Approach. We use a comprehensive, cross-departmental approach for identifying, evaluating, preventing and/or mitigating cybersecurity threats and incidents, and have implemented controls and procedures that provide for the prompt escalation of significant cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner. • Technical Safeguards. We deploy technical safeguards intended to protect our IT networks and related systems from cybersecurity threats, including firewalls, intrusion prevention, detection and isolation systems, anti-virus and malware functionality, backup functionality. and access controls. These technical safeguards are regularly evaluated and improved through vulnerability assessments, network penetration testing and threat intelligence, including by third-party consultants, who also continually monitor our information security. Any significant developments related to our technical safeguards, including the results of any vulnerability assessments or network penetration testing, are reported to our board of directors, and we adjust our cybersecurity risk management policies and practices as necessary. • Management of Third-Party Risks. We use a risk-based approach to evaluating cybersecurity risks presented by third parties, such as vendors, service providers, and external users of our IT networks and related systems, as well as risks related to our use of third-party systems that could adversely affect our business in the event of a cybersecurity incident centered on those systems. • Education and Awareness. We provide regular, mandatory cybersecurity training for our employees to help them identify and avoid potential cybersecurity threats and understand our policies and guidelines related to our IT network and related systems. As part of this training program, we regularly test our employees for information security awareness, including through random electronic communications designed to simulate how a threat actor might attempt to compromise our IT network and related systems. • Cybersecurity Insurance. We carry comprehensive cyber liability insurance coverage that covers us against claims related to certain first-party and third-party losses, including data restoration costs and crisis management expenses, subject to the policy's coverage conditions and limitations.

companyName: STAG Industrial, Inc.

ticker: STAG


text: We also engage third-party resources to assist in our cybersecurity program, including annual ISO 27001 assessments of our cybersecurity program, validation of our SOC2 controls' operational effectiveness for certain products, and retaining leading cybersecurity experts as needed in response to cybersecurity incidents and for other consultative needs (e.g., due diligence of potential acquisitions).

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with management. Personnel at all levels and departments know our cybersecurity policies through training. Random attack simulations are conducted monthly to familiarize all personnel with various phishing methods with positive reinforcement on identifying and reporting suspicious content to the IT Department.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs, which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.

companyName: West Bay BDC LLC


text: The Audit and Risk Committee, together with the full Board of Directors, actively oversees the Company's cybersecurity program. The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls from the CIO on a quarterly basis, and more frequently when necessary. These reports include updates on the activities of the Executive IT Council. Changes to the Company's information security policies and programs are approved by the Audit and Risk Committee. This information is reported to the full Board of Directors which, together with the Audit and Risk Committee, evaluates and considers the effectiveness of the Company's risk management policies and controls relating to cybersecurity that are described in the section above.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: The Board has tasked the SMT with overseeing efforts to develop, implement and maintain an effective information and cybersecurity program. The SMT designates the CISO who also serves as the IRT leader. As part of its oversight responsibilities, the Board of Directors is responsible for discussing with the SMT our company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including our risk assessment and risk management policies. The Board of Directors also monitors our compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, our Tech Oversight Committee reviews with the SMT significant areas of risk exposure involving cybersecurity.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: As part of our cybersecurity program, we undertake various activities and programs, including, but not limited to: detective, preventative, corrective, and technical controls; identity and access management systems; periodic risk assessments, including penetration testing; periodic end-user training and simulations; incident response; vulnerability management; infrastructure and application security; corporate security; and policies for the handling of personally identifiable information and other restricted data.

companyName: Compass, Inc.

ticker: COMP


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks as part of its risk management oversight. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports from the CIO regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: Our domestic cybersecurity program is overseen by our Head of Cybersecurity, Louie Garcia. Mr. Garcia has almost 20 years of cybersecurity experience, spanning threat perspectives, cyber exercise development and training, enterprise vulnerability assessments, defensive and offensive network solutions, and operational evaluation of cyber products.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks have materially affected the Company, including its business strategy, results of operations or financial condition. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: The Risk Committee is informed of risks from cybersecurity threats through regular reports from the Company's management, including our CISO and CTO. Our CISO and CTO, who are employees of our subsidiary NTS, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Risk Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to the Risk Committee, as well as the risk committee of the board of directors of Newtek Bank, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Managing Material Risks & Integrated Overall Risk Management To manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls ("Cyber Risk Controls"), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss, and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: We execute a comprehensive cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program is aligned with industry-wide recognized standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cybersecurity threats; and continuous improvement of our cybersecurity measures. The Company has established comprehensive incident response and recovery plans, regularly tests and evaluates the effectiveness of those plans, and maintains cybersecurity risk insurance.

companyName: MONRO, INC.

ticker: MNRO


text: We prioritize the management of cybersecurity risk and the protection of information across the Company by embedding data protection and cybersecurity risk management in our operations. The Company follows the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and other industry standards and applicable laws and regulations to assess and manage cybersecurity risks within our services, infrastructure, and corporate resources. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes through a layered governance structure.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Our Information Technology department works collaboratively with our third party vendors to coordinate a mutually beneficial approach to cybersecurity in the specific context in which risk is presented. These collaborations sometimes take place on a rolling basis, and sometimes take place on a semi-annual or annual basis.

companyName: FONAR CORP

ticker: FONR


text: Our business is dependent on the communications and information systems of the adviser, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board's Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company's senior management, including our ECCRT (as defined below), and the Board. Under the guidance of our CISO, the Response Process is routinely evaluated, tested and updated as appropriate. In addition to our Response Process, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents. For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction. Accordingly, we require employees to complete periodic access-based and role-based privacy and cybersecurity training. These trainings are routinely updated to reflect changes in the threat environment, assessment, and/or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.

companyName: Cencora, Inc.

ticker: COR


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect AGBA, including our business strategy, results of operations, or financial condition. Refer to "Part I, Item 1A—Risk Factors—Risks Factor Relating to AGBA's business—Unexpected network interruptions, security breaches, cyberattack or computer virus attacks, and failures in AGBA's information technology systems, could have a material adverse effect on AGBA's business, financial condition, and results of operations" in this Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Triller Group Inc.

ticker: ILLR


text: Board of Directors The Corporate Risk Committee of our Board of Directors oversees our information technology systems, including information security, compliance and privacy. Additionally, the Audit Committee of our Board of Directors oversees adequacy and effectiveness of our controls and procedures, including those designed to assess, identify and manage material risks from cybersecurity threats and incidents. Further, at least bi-annually, our CIO and/or CISO report on cybersecurity matters to the Corporate Risk Committee, and updates are provided to our Board of Directors at regular board meetings. The CIO also provides updates annually or more frequently as appropriate to our Board of Directors. Our ERM team reports annually on the company's risks to our Board of Directors, which includes progress related to mitigation activities and risk conditions.

companyName: CHS INC

ticker: CHSCP


text: Our information systems align with industry security standards. Our cybersecurity program, where appropriate, aligns with the Center of Internet Security ("CIS") Control framework, which itself is modeled after the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework ("CSF").

companyName: Installed Building Products, Inc.

ticker: IBP


text: We design our program based on industry standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Also, our cloud services comply with numerous internationally recognized standards, such as ISO 27001, ISO 27017, ISO 27108, SOC 2 and CSA STAR.

companyName: Intapp, Inc.

ticker: INTA


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Xencor Inc

ticker: XNCR


text: MPC's CISO works at the direction of MPC's CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers. Prior to joining MPC in 2021, its CDO was employed by General Electric Company ("GE") and its subsidiary companies for over 20 years, holding several executive IT leadership roles with increasing responsibility. He was then named Senior Vice President and Chief Information Officer of Services for parent company GE in 2017 and was later named the Vice President and Chief Information Officer of GE Healthcare. MPC's CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.

companyName: MPLX LP

ticker: MPLX


text: We have developed a comprehensive cybersecurity program, modeled after the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), that forms a critical component of our overall risk management and business strategy and provides for a methodological approach to identifying, assessing and managing material risks from cybersecurity threats. Our risk assessment protocol considers both probability of occurrence and potential impact to our business and is predicated on the pillars of risk identification, analysis and mitigation. Execution of our cybersecurity program is coordinated by our management, dedicated cybersecurity employees and third-party providers. While no particular cybersecurity risk or incident has unilaterally influenced our strategy, we allocate a portion of our operational and capital budgets towards sustaining and improving our cybersecurity defense posture, in addition to maintaining tailored insurance coverage. We value the importance of safeguarding digital assets, ensuring trust, and operational continuity amidst evolving threats. By prioritizing cybersecurity, we endeavor to protect our interests and uphold our commitment to our stakeholders' security and privacy.

companyName: TaskUs, Inc.

ticker: TASK


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST"). We execute an NIST 800 - 53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.

companyName: Fluent, Inc.

ticker: FLNT


text: We intend to work with outside counsel and third-party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan. date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.

companyName: NextTrip, Inc.

ticker: NTRP


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. Our CISO has more than 20 years of experience managing information security for media/entertainment, technology, retail and financial services companies. While at Paramount, our CISO oversaw the integration of Viacom's and CBS's information security programs and our transformation to a cloud-centric, global streaming provider.

companyName: Paramount Global


text: D.R. Horton's CIO has more than 35 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, the D.R. Horton CIO has led governance, risk, and compliance technology programs and information security programs. The D.R. Horton CIO currently reports to the D.R. Horton CFO.

companyName: Forestar Group Inc.

ticker: FOR


text: The Cybersecurity Risk Management and Strategy, Governance, and Incident Disclosure Program (the "Program") of Customers consists of six key areas focused on technology governance and compliance, standards management and architecture, physical security, application security, cybersecurity operations, and workforce training and preparedness. The Corporate Security Group manages Customers' documented security and cybersecurity incident ("Incident") response and business continuity functions and utilizes annual table-top exercises to test Customers' preparedness for any Incidents ranging from pandemics to cybersecurity events. Incidents are classified with a priority Level 1 (low) to a priority Level 5 (high) rating. Priority Levels 4 and 5 Incidents that may cause material or significant disruption to Customers are immediately reported to Customers' Directors Risk Committee for appropriate disclosure in a Current Report on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity Incidents. Our Incident Management Process is illustrated below.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting are in the process of establishing a cybersecurity policy designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization and implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy will encompass the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risks; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage any material risks.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: If required, we engage consultants, or other third parties in connection with our risk assessment processes. These service providers, where appropriate, assist us in the assessment, testing or other aspects of our security controls to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment, as well as assist us in designing and implementing our cybersecurity policies and procedures.

companyName: Lite Strategy, Inc.

ticker: LITS


text: The Board recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: STRYVE FOODS, INC.


text: When a cybersecurity threat or incident is identified, the Chief Information Security Officer works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, the Cybersecurity Committee, and the Board, as necessary, regarding significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, employees and stakeholders, and continues to provide regular reports until such incidents are concluded.

companyName: TOYOTA MOTOR CREDIT CORP


text: Monitoring of Cybersecurity Incidents Our Cybersecurity Incident Response Plan establishes how we monitor and respond to cybersecurity incidents impacting our environment. The CISO works closely with members of our Executive Leadership Team and his cybersecurity team to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. We engage a third-party managed security services provider (MSSP) to provide 24/7 continuous monitoring of the Company's IT and operational technology environments for potential cybersecurity incidents. In the event such an incident is identified by our MSSP or any of our employees, the incident is assigned a severity classification (minor, moderate or major) by our cybersecurity team and escalated accordingly. Depending on the severity of the incident, certain key personnel are notified and work together to further investigate the incident and take actions to respond, which may include engaging with external specialists, regulatory authorities and our cybersecurity insurance carrier. The CISO receives daily and weekly updates on all incidents and incident responses, which the CISO shares with our Executive Leadership Team on a weekly basis. Our cybersecurity team conducts a post-incident review of all major cybersecurity incidents, which review includes identification of vulnerabilities, assessment of the incident's impact on the Company and recommendations to help prevent similar incidents in the future.

companyName: ENTEGRIS INC

ticker: ENTG


text: Our Information Security Program (the "Program") is designed to protect personal and proprietary information in compliance with federal and state requirements. The Program aims to: • ensure the security and confidentiality of employee and customer personal information, as well as Company proprietary information; • protect against anticipated threats or hazards to the security or integrity of such information; and • prevent unauthorized access to, use of, or transfer of such information, thereby protecting the Company, its employees, and customers from potential harm or inconvenience.

companyName: Outdoor Holding Co

ticker: POWW


text: Crexendo relies on a number of third-party vendors and contractors in order to provide products and services to its customers as well as to augment the resource pool. On an annual basis, all significant third-party vendors and subservice organizations are assessed for any applicable cybersecurity or service availability risks. Vendors and contractors with access to sensitive data and/or information are expected to meet certain information security requirements.

companyName: Crexendo, Inc.

ticker: CXDO


text: In 2023, ASGN has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.

companyName: ASGN Inc

ticker: ASGN


text: Engage Third-parties on Risk Management Understanding the ever-changing and complex nature of cybersecurity threats, our organization values collaboration with external experts, including cybersecurity consultants, for advisory purposes. These collaborations are aimed at enhancing our understanding and management of cybersecurity risks. Through such engagements, we seek to gain insights and recommendations on improving our risk management frameworks and responses to potential cybersecurity incidents.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Our third line of defense is the internal audit function led by our Vice President, Internal Audit, which plays a crucial role by providing independent and objective assurances on the design and operating effectiveness of our cybersecurity risk management and internal controls through the performance of audits and reviews. Internal audit engages external consultants and subject matter experts as appropriate to assist in the assessment of management's cybersecurity program and reports the results directly to the Board.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Depending on the technology environment, we implement and maintain various technical, physical, and organizational measures, in the form of policies, standards, processes, and technical capabilities, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things, internal reporting, annual and ongoing cybersecurity awareness training for employees, mechanisms to detect and monitor unusual network activity, as well as threat detection, containment, incident response and backup recovery tools.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Gover nance Given the importance of information security, privacy and data protection to our stakeholders, cybersecurity is a critical part of our risk management program and a key focus area for our Board and Executive Management. The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help manage our risk exposure to meet our strategic objectives. Executive Management and our Information Security Officer ("ISO") regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Our information security and risk management program is designed to identify, assess, and manage material risks from cybersecurity threats to our applications, computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, personal information, or protected health information (PHI) (collectively, "Information Systems").

companyName: OptimizeRx Corp

ticker: OPRX


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and our vendors have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the section entitled "Risk Factors — Risks Related to Information Technology and Data Privacy".

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Trinseo's business and production operations rely on secure access, processing, storage, and transmission of company confidential and personal identifiable information within various technology platforms. The Company has processes in place to monitor, identify, assess and respond to material risks from cybersecurity threats. We maintain a cyber risk management program to identify, protect, detect, respond and recover from cyber threats and incidents. Our cybersecurity risk management and internal controls programs are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Trinseo PLC

ticker: TSEOF


text: Our CIO and CISO also lead our Cyber Fusion Center ("CFC"), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Our board of directors oversees our risk management programs, strategies and processes. The board of directors also assigns certain oversight responsibilities to its committees and has assigned the audit committee to oversee our guidelines, policies and practices regarding risk assessment and risk management as they relate to cybersecurity.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the Computer Systems Operations Manager and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: Fifth District Bancorp, Inc.

ticker: FDSB


text: At the direction of the SMT, the CISO and IRT monitor internal and external cybersecurity threats and review and revise our company's cybersecurity defenses on an ongoing basis. The CISO, together with other members of the IRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Board of Directors on a regular basis, and the CISO presents those reports to the SMT and Board of Directors and addresses any questions and concerns raised by the SMT and Board of Directors. At least annually, the Board of Directors meets with the CISO in person to discuss cybersecurity in greater detail.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We have not experienced a material cyber breach in the last three years. We do not believe that any risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to the Company associated with cybersecurity incidents, see "In the event of a cybersecurity incident, we could experience operational interruptions, incur substantial additional costs, become subject to legal or regulatory proceedings or suffer damage to our reputation," included in Part I, Item 1A (Risk Factors) of this Annual Report.

companyName: TopBuild Corp

ticker: BLD


text: We have experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to our business, we may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, we are not aware of any such attacks that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, refer to "Risks Relating to Our Business – A major failure of our information systems could harm our business; increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks and products." in "Item 1A. Risk Factors within this Form 10-K.

companyName: TRIMAS CORP

ticker: TRS


text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including IT leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. We periodically engage third-party audit and legal firms with industry-recognized expertise on cybersecurity matters to review specific aspects of our cybersecurity enterprise risk management framework and controls.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: We incorporate results of these risk assessments to our policies and procedures, to maintain reasonable safeguards on an ongoing basis to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: As of the date of this Annual Report on Form 10 -K, we have not identified risks from known cybersecurity threats, including or as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks to us from cybersecurity threats, see "Risk Factors" in Item 1A. of this report.

companyName: VERU INC.

ticker: VERU