text: Bio-Techne's General Counsel updates the Audit Committee multiple times per year regarding Bio-Techne's cybersecurity programs, including regularly-tracked metrics on incident response, internal security testing, and measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Audit Committee regularly updates the full Board on these matters. In addition, the CISO and/or CIO provides the full Board with a thorough review of the Company's cybersecurity program, including current status, industry risks and exposure, and future strategy.

companyName: BIO-TECHNE Corp

ticker: TECH


text: The Corporation's cybersecurity risk management systems processes, which are formalized in the Corporation's cybersecurity risk management policy, include security controls, monitoring systems, tools and related services, and oversight from each of RCM, our officers and our third-party IT service provider in assessing, identifying and managing risks from cybersecurity threats. The Corporation, through our third-party IT service provider, has implemented and expects to continue to implement risk-based controls designed to prevent, detect and respond to information security threats. We rely on these controls to help us protect our information, our information systems, and the information of third parties who entrust us with their sensitive information.

companyName: RAND CAPITAL CORP

ticker: RAND

secItem: Item 1C


text: We have not, to date, experienced a cybersecurity incident that was determined to be material, although, as a technology provider, we have experienced incidents in the past. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A, Risk Factors" in this Annual Report on Form 10-K.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: The CIO provides regular updates to the Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), as well as other members of Davey's executive leadership team, as deemed necessary, on matters relating to cybersecurity. In addition to scheduled briefings, the CIO maintains an ongoing dialogue with our executive leadership team regarding emerging or potential cybersecurity risks.

companyName: DAVEY TREE EXPERT CO


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Blue Owl's Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Real Estate Net Lease Trust


text: In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems are important to our operations and business strategy. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to review and discuss with management the Company's risk assessment and risk management policies, including the steps that management has taken to monitor and control related cybersecurity risks and exposures. Management updates the Audit Committee and the Board as necessary about significant cybersecurity occurrences and measures the Company is taking to prevent the same.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: In today's digital landscape, cybersecurity is a critical component of our business operations. We are committed to safeguarding information systems, data, and technology infrastructure from potential cyber threats, unauthorized access, and data loss. We have implemented robust policies, procedures, and security measures to mitigate risks, ensure compliance with applicable laws and regulations, and maintain the trust of our stakeholders.

companyName: Bubblr Inc.

ticker: BBLR


text: We are certified to ISO 27001, 2022 and have satisfied the requirements for Information security, cybersecurity and privacy protection — Information security management systems (ISMS).

companyName: Renalytix plc

ticker: RNLXY


text: In addition, in furtherance of our fiduciary responsibility to protect and account for information and information systems that are recognized as critical bank assets, we have established policies that require, among other things, that we perform an information security risk and vulnerability assessment at least annually, and implement corresponding risk management controls; implement a defense-in-depth security architecture, which may include firewalled network segmentation, malicious software protection, and data loss prevention; leverage data loss prevention technology to assist in preventing unauthorized disclosure of non-public information; and engage independent third parties to review, audit, and test the information security control structure and program to ensure processes and controls are functioning properly.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: We have an incident response plan supported by a dedicated team to address cybersecurity incidents. This includes vulnerability identification, initial assessment, and engagement of external experts as needed.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We are in the process of implementing a structured cybersecurity risk management framework designed to assess, identify, and manage material risks from cybersecurity threats. These processes are being integrated into our overall enterprise risk management system to ensure that cybersecurity considerations are embedded within broader risk assessment and mitigation efforts. As part of this framework, we plan to engage qualified third-party consultants and auditors to assist in identifying risks, validating controls, and supporting continuous improvement. We also intend to establish oversight procedures to evaluate and monitor risks associated with our use of third-party service providers.

companyName: VERDE RESOURCES, INC.

ticker: VRDR


text: Risk assessment process, including threat identification and assessment Risk management and control decisions, including risk acceptance and avoidance Third-party service provider arrangements

companyName: Prime Meridian Holding Co

ticker: PMHG


text: The Director of IT is promptly informed of potential cybersecurity risks, threats, and vulnerabilities by the Company's IT Helpdesk. Once an incident has been identified, the Director of IT and the IT network security team assess the criticality and impact of the incident on the Company's business operations. The Director of IT then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging senior leadership on all material incidents.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: the deployment of third-party cybersecurity experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities; and of the cybersecurity risks posed by interacting with current and potential third-party service providers, suppliers and customers.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: ORIX USA employs a 'defense in depth' cybersecurity strategy and program based on the NIST Cybersecurity Framework, which includes multiple layers of security policies, protections, and controls designed to safeguard the confidentiality, integrity, and availability of infrastructure, network and information assets from malware and threats. This includes the deployment of firewalls, email protection technologies and web gateway, antivirus, and endpoint detection and response ("EDR") systems.

companyName: BCTC IV ASSIGNOR CORP


text: Our cybersecurity risk management program includes but is not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • an annual tabletop exercise conducted by a third party to simulate a cyber emergency and practice our response to such a scenario; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for relevant service providers, suppliers, and vendors.

companyName: Commerce.com, Inc.

ticker: CMRC


text: The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.

companyName: TCW Direct Lending VII LLC


text: Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving. For more information on the Company's cybersecurity risks, refer to Item 1A, "Risk Factors".

companyName: QHSLab, Inc.

ticker: USAQ


text: These activities include, but are not limited to, engaging an external third-party to monitor information systems security events, conducting annual security training of employees, testing employees via periodic phishing campaigns, conducting system vulnerability scanning, utilizing a patching program to remediate critical patches, and utilizing an external third-party to perform testing to identify gaps in the Company's security program. The Company also performs third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. Additionally, for providers of software-as-a-service and other services that hold Company data, the Company reviews and assesses industry standard certifications such as System and Organization Controls (SOC) 1 or SOC 2 reports and cybersecurity preparedness questionnaires. Mitigation of risk efforts are coordinated by the Company's Director of Information Security, utilizing internal resources and third-party providers.

companyName: TREX CO INC

ticker: TREX


text: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: We currently maintain a cybersecurity insurance policy that provides coverage for security incidents and periodically meet with our insurer to discuss emerging trends in cybersecurity. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, notwithstanding the programs, policies and procedures described above, there can be no assurance that we or businesses with which we interact will not experience a cybersecurity incident that materially affects us in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, including the failure to protect the integrity or availability of IT systems or the security of confidential information, or the introduction of malware or ransomware, could harm our business." in Item 1A. Risk Factors of Part I of this Annual Report on Form 10-K.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Enterprise Risk Management The Company utilizes a structured, biannual ERM process to identify, assess, and address material risks facing the Company, including cybersecurity risks, during which business leaders across the Company are surveyed about current and emerging risk areas. After the ERM survey is completed and risk areas are identified, the results are discussed with the relevant management personnel across the organization in the key risk areas, root causes are analyzed, risk mitigation plans are developed, and key risk indicators are utilized to monitor mitigation efforts. The Chief Information Officer works closely with the Company's management team in all facets of its ERM risk mitigation activities related to cybersecurity and information security risks.

companyName: OMNICELL, INC.

ticker: OMCL


text: Our cybersecurity functions include representatives from information technology, information security, legal, impacted business units or products and other departments as applicable (together, the "Cybersecurity Team") helps identify, assess and manage the Company's cybersecurity threats and risks. The Cybersecurity Team identifies, assesses and manages cybersecurity risks by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools such as vulnerability scans, penetration tests and a public bug bounty program; subscribing to reports and services that identify cybersecurity threats; conducting risk assessments and internal and external audits; using external intelligence feeds; and conducting tabletop incident response exercises.

companyName: NETGEAR, INC.

ticker: NTGR


text: We regularly engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.

companyName: IDT CORP

ticker: IDT


text: Our cybersecurity risk management program, which is designed to protect the confidentiality, integrity and availability of our critical systems and information, includes a comprehensive cybersecurity incident response plan.

companyName: Avery Dennison Corp

ticker: AVY


text: We have developed and maintain a robust cybersecurity incident response plan, led by the CSO. JFrog's cybersecurity incident response team has a comprehensive strategy and policies in place for managing security incidents. Along with swift threat classification, containment, and eradication, the strategy includes notification procedures to promptly inform and support stakeholders in accordance with applicable data breach notification laws. Incident analysis is carried out to understand root causes and drive continuous improvement.

companyName: JFrog Ltd

ticker: FROG


text: The Company's risk management program is designed to identify, assess, and mitigate risks across various areas and functions, including financial, operational, technological, regulatory, reputational, and legal. Cybersecurity is a critical component of the risk management program. The Company's information security program is designed to protect the security, availability, integrity, and confidentiality of its computer systems, networks, software and information assets, including customer and other sensitive data.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: A security team led by our Chief Information and Technology Officer principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;

companyName: Shake Shack Inc.

ticker: SHAK


text: Program Highlights Our program is anchored by our Enterprise Information Security Framework ("EISF"), which adheres to the guidelines set forth by the National Institute of Standards and Technology ("NIST") 800-53 Framework. To enhance comprehensiveness, our policies also harmonize with other leading frameworks such as the ISO 27001 Standard, Family Educational Rights and Privacy Act of 1974 ("FERPA"), Payment Card Industry Data Security Standard ("PCI DSS"), Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act ("CCPA"), General Data Protection Regulation ("GDPR"), and other pertinent local, state, national, and international regulations governing data privacy and information security.

companyName: Covista Inc.

ticker: CVSA


text: NetApp's CISO is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 30 years of experience in IT and information security, including over 16 years with NetApp in roles of increasing seniority, and is a Certified Information Security Auditor, Certified Information Security Manager with ISACA and a Certified Information Systems Security Professional with ISC2. The CISO stays informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.

companyName: NetApp, Inc.

ticker: NTAP


text: We have developed a cyber crisis response plan for handling high severity security incidents and coordinating across multiple parts of the company. Our incident response team monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform training, simulations, and drills across company personnel.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our Manager's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for existing third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: The Company implements and maintains technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include, for example: risk assessments, implementation of certain security standards and certifications, encryption of certain data, access and network security controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and an incident response plan. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the ISMS maintains a risk register related to information and security threats and evaluates and manages material risks from cybersecurity threats against our overall business objectives. This information is communicated to the audit committee of the board of directors, which evaluates the Company's risks relating to data privacy, technology and information security, including cybersecurity.

companyName: Vor Biopharma Inc.

ticker: VOR


text: Outbrain uses COBIT, or Control Objectives for Information Technologies, as a framework for risk management and manages various controls as required by ISO 27001, 27017 and 27032 standards. Outbrain maintains the following certifications: ISO 27001, ISO 27017 and ISO 27032, Cloud Security Alliance Star level 1 and PCI-DSS SAQ A-EP. Outbrain's on-premises data centers are SOC 2 certified. Teads utilizes NIST as a framework for risk management and manage various controls as required by SOC2 Type 2. Teads maintains the SOC2 Type 2 certification and its cloud infrastructure providers are ISO 27 certified. In addition to our certifications, we (i) conduct routine employee training sessions and onboarding security training, including phishing simulations, to increase awareness of phishing and other cyber threats; (ii) require multi-factor authentication access methods for all employees into our network; (iii) operate general monitoring and service protections that are subject to continuous enhancements to detect and mitigate various threats, including performing ongoing manual and automatic vulnerability assessment tests; and (iv) manage an ongoing cyber risk-management framework to assess internal technological changes, as well as external systems and services as part of supply chain risk.

companyName: Teads Holding Co.

ticker: TEAD


text: Through this robust governance structure, involving Board oversight, senior management leadership, and a cross-functional committee, we maintain a proactive and comprehensive approach to managing cybersecurity risks across the organization.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Our cybersecurity risk management program is integrated into our enterprise risk management processes and is informed by recognized cybersecurity industry frameworks and standards, including the National Institute of Standards and Technology. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information systems and assets (for example, B&W business information and information resources such as computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multi-factor authentication and malware defenses. We also work with internal stakeholders to integrate foundational cybersecurity principles throughout our operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee (the "Committee"). The Committee oversees the implementation of the cybersecurity risk management program.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: The ARC Committee reports to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board also receives briefings at least annually from management on our Information Security Program. Board members receive presentations on cybersecurity topics from our CISO and external experts from time to time as part of our continuing education to Board on topics relevant to their service as a member of our Board.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: We continue to invest in our cybersecurity program to help ensure that we have the necessary resources to execute our business operations and that our workforce is prepared to work in an active cyber-threat environment. These resources also include external service providers with experience in third-party risk monitoring and cybersecurity threat intelligence, detection and response. Mandatory training is required on a quarterly basis for all CFC employees to promote leading practices in protecting information, data and operations in a continually changing environment. We established requirements regarding the use of company-approved generative artificial intelligence tools to ensure that all employees utilize such tools in a manner that safeguards sensitive information and aligns with legal requirements and CFC's ethical standards.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: A.Board of Directors' Oversight of Risks from Cybersecurity Threats The Company's Board considers cybersecurity risk as critical to the enterprise. The full Board oversees the Company's Enterprise Risk Management program which incorporates cybersecurity risks together with other top operational, reporting and compliance risks the Company manages. The full Board is kept apprised by Management of the Company's cybersecurity risk assessment results, and an escalation process exists to inform the Board of high-severity cybersecurity incidents that may occur. In addition, the Board periodically engages independent third-party technology experts to test the Company's information technology systems, including cybersecurity.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: During 2024, members of o ur Cybersecurity Governance Committee included our Chief Financial Officer, Vice President of Software, Senior Manager of IT, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. Our Chief Financial Officer, Corporate Controller, Director of SEC Reporting and Technical Accounting and Director of Internal Audit each have a number of years of experience in auditing internal controls and assessing risk processes of public companies, including controls involving a company's information technology systems. Our Vice President of Software has a number of years of experience leading software development efforts, including ensuring new software has proper safeguards included to minimize the risk of cybersecurity events. Finally, our Senior Manager of IT has a number of years of experience in implementing and monitoring controls and processes in a company's information technology systems environment that are designed to minimize the risk of cybersecurity events. Accordingly, we believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for the years ended December 31, 2024, 2023 and 2022. Delek continuously assesses and enhances the confidentiality, integrity, and availability of its IT and OT assets.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Our Audit Committee and management meet with the Board on a quarterly basis to provide updates on cybersecurity risks, material cyber-attacks and security incidents as they occur, as well as to promote company-wide cyber risk and security awareness. Additionally, our Chief Information Officer and Director of Cybersecurity meet periodically with the Board or the Audit Committee to brief them on technology and information security matters.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: A dedicated team of technology professionals monitors and manages cybersecurity risks. They are led by our Chief Technology Officer (CTO), who has served in senior leadership positions with responsibility for cybersecurity and IT risk management for over 10 years, and our Vice President, Management Information Systems (VPMIS), who has been a Certified Information Systems Security Professional (CISSP) since 2016. Their teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our CTO and VPMIS regularly engage with our Chief Administrative Officer. They also report monthly on cybersecurity matters to our entire executive management team.

companyName: Public Storage

ticker: PSA


text: J FG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision, design, development and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis, as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues. Protective measures, where appropriate, include, but are not limited to, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring, hardware and software, and data erasure and media disposal. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").

companyName: Jefferies Credit Partners BDC Inc.


text: The cybersecurity group for Customers reports to the Chief Information Officer and is overseen by Customers' Directors' Risk Committee. Our Program is led by the CISO. The Program has been designed to conform with the National Institute of Standards & Technology's ("NIST") Cybersecurity Framework, International Organization for Standardization ("ISO") 27001, as well as the FFIEC guidelines for cybersecurity. We use these frameworks to assist our organization as it seeks to ensure the confidentiality, integrity, and availability of technology and services for its customers, employees, and partners. Our Program is ISO 27001 certified and is audited annually by an external accredited ISO 27001 certification body.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.

companyName: Ellington Credit Co

ticker: EARN


text: Defined administrator accounts with appropriate access levels Documentation of system access credentials Regular updates to firmware on network infrastructure (current versions documented)

companyName: OZOP ENERGY SOLUTIONS, INC.

ticker: OZSC


text: In the normal course of business, we proactively manage and monitor cybersecurity activities. To date, these efforts have successfully prevented any incidents that could materially affect our business strategy, operational results, or financial condition. We remain vigilant and are not currently aware of any threats that pose a material risk.

companyName: Cineverse Corp.

ticker: CNVS


text: Currently, our Chief Operating Officer is expected to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: Comprehensive cyber insurance coverage, including protection against social engineering fraud and other cyber incidents, to further mitigate potential financial losses.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: HCTI faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See "Item 1A. Risk Factors" for additional information regarding our organization's cybersecurity risks, which should be read together with this "Item 1C. Cybersecurity".

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: As a component of the Company's overall risk management process, which is aligned with a broader Enterprise Risk Management framework, the Company has implemented a multi-layered approach to minimize cybersecurity risk and safeguard its data. The Company conducts cybersecurity risk assessments on a regular basis and responds to identified risk exposures by employing a combination of risk mitigation strategies, including the adoption of cybersecurity controls and maintaining a cybersecurity insurance policy that provides coverage for security breaches. The Company engages third party consultants periodically to evaluate elements of the cybersecurity policy, processes, procedures and controls. The CISO and other members of the Executive Leadership Team respond to applicable recommendations arising from the third-party consultants. In addition, the Company engages a Qualified Security Assessor as part of the compliance requirements for Payment Card Industry (PCI). The Company also engages with a third-party risk management provider to ensure its vendors comply with internal security and privacy requirements and that key vendors are continually monitored for security risks. The Company's cybersecurity governance practices are based on the Company's common control framework which incorporates elements from the NIST Cybersecurity Framework, the Center for Internet Security's benchmark standards, and specific regulatory and industry requirements including Health Insurance Portability and Accountability Act and PCI. The CISO provides at least quarterly updates on the cybersecurity program, including the results of the cybersecurity risk assessments and the related responses, to the Company's Security Governance Council composed of members of the Executive Leadership Team. The Company continually monitors cybersecurity threats and has a dedicated cybersecurity team in place to identify if any of the threats may lead to a cybersecurity incident. In the event of such an incident, the Company will take decisive measures to thoroughly analyze, contain, and eliminate the threat. Following an incident, a comprehensive review is performed to determine whether the incident meets qualitative or quantitative materiality thresholds, and whether the incident warrants public disclosure.

companyName: SpartanNash Co


text: Vendor risk management: As part of our risk management program, our vendor risk management teams are responsible for conducting due diligence on vendors submitted for risk evaluation where medium- or high-risk data are in scope. We require assessments of these third-party vendors prior to establishing a business relationship, and monitor high-risk vendors on an ongoing basis, as part of our efforts to require these vendors to maintain their commitments related to data security, availability and confidentiality. Our security team's assessment of vendors' security controls and processes is calibrated to the risk level assigned to the vendor.

companyName: HUBSPOT INC

ticker: HUBS


text: Our CIO has Bachelor of Science degrees in Information Technology and Business Administration and Science and has served in various roles in information technology for over 30 years, including nearly 20 years in roles directly related to implementing and managing cybersecurity measures.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: When security events do occur, we employ a security incident response process that is designed to contain, eradicate, and recover operations as quickly as possible, while preserving forensic evidence for further analysis and potential attribution. We leverage multiple third parties for incident response and forensic support on retainer as necessary to assist during the incident response and remediation phases. We also maintain cybersecurity insurance in the event of cybersecurity related damages or data loss as a result of a cybersecurity incident or unauthorized data disclosure.

companyName: VIASAT INC

ticker: VSAT


text: Our Information Security team uses automated technology, third-party partners, and direct review of system indicators to monitor and implement the prevention, detection, mitigation, and remediation of cybersecurity incidents, and to stay current with the changing threat landscape. We also leverage encryption technologies and other measures to safeguard systems. We engage third parties as part of our cyber program, including external security firms that provide security technology, conduct regular security audits, and conduct penetration testing. We also engage third parties to conduct regular drills, such as tabletop exercises, to help with our overall preparedness.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: We face risks associated with cybersecurity. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors - The occurrence of security breaches and cyber-attacks could negatively impact our business." and "- Our business may be subject to a variety of PRC laws and other obligations regarding cybersecurity and data protection."

companyName: IT TECH PACKAGING, INC.

ticker: ITP


text: External resources: Tyler leverages third-party assessments, intelligence services, audits, and reporting obligations to provide additional layers of accountability, monitoring and testing. This includes a bug reporting program that we publish that invites any third party to report a security vulnerability they have identified. We also use a Qualified Security Assessor to perform an annual Payment Card Industry Data Security Standards assessment that tests our credit card data controls, and we undergo an annual System & Organizational Control audit to generate a report of our key compliance controls and objectives, among other things. Given our technology in the courts and public safety markets, we also manage compliance with Criminal Justice Information Systems security standards that are established by the Federal Bureau of Investigation ("FBI"), and we partner with our clients and third-party Criminal Justice Information Services ("CJIS") compliance consultants to ensure that we adhere to the requirements applicable to us.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Information security and privacy are important concerns, with an escalating cyber-threat environment and evolving regulatory requirements driving continued investment in this area. Our information security program is designed to meet or exceed industry best practices and is integrated into our broader ERM framework. We are subject to a number of cybersecurity and data privacy laws and regulations, such as those promulgated by the BMA, Office of the Privacy Commission, NYDFS, MIA, and the EU. Pursuant to applicable regulations, we have established and maintain a cybersecurity program designed to protect our information technology systems and customer data. Our program is designed to comply with all applicable cybersecurity regulatory requirements, including disclosure requirements, and we continue to evaluate and assess our compliance in the changing regulatory environment. It is likely that we will be subject to new regulations that could adversely affect our operations or ability to write business profitably in one or more jurisdictions. We cannot predict what, if any, regulatory actions may be taken with regard to "big data" or emerging technologies, such as artificial intelligence, but any actions could have a material impact on our business, business processes, financial condition, and results of operations.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: Prioritize and scope. Identify organization objectives and priorities and determine the scope of systems and assets that support the selected business line or process.

companyName: ATEL 14, LLC


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to cyber risk management ("CRM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's CRM program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: The Company maintains a third-party risk management program designed to identify, analyze and monitor risks, including cybersecurity risks, associated with vendors and outside service providers. Our vendor risk management team collaborates closely with the information security team to ensure third parties meet certain information security control requirements. Our information security team proactively monitors our internal systems and email gateways for phishing email attacks. Remote connections are also assessed and monitored given a portion of our workforce works remotely. Personnel serve as members of both teams helping to effectively identify and communicate issues as they develop.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: We and our third-party vendors employ information technology, including networks, systems, and applications, to support our business processes and decision-making in our business. Our information technology infrastructure supports the flow of information throughout our business processes and is susceptible to cybersecurity threats. Accordingly, we have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: In addition, we have processes designed to oversee and identify cybersecurity risks associated with our use of third-party service providers. Where appropriate based on the data and intellectual property to which these providers are reasonably expected to have access, we conduct security assessments and due diligence reviews of third-party systems for compliance with our security standards, and we include data protection language in our agreements with these third parties.

companyName: Walt Disney Co

ticker: DIS


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: Talkspace, Inc.

ticker: TALK


text: • Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks using the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Framework as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan. • Insurance. We maintain an information security risk insurance policy. • Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis. • Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications. • Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: We use a cross-departmental approach to addressing cybersecurity risk, with our cybersecurity, product security and legal teams presenting quarterly on key topics to a committee of leaders in finance, regulatory, and corporate affairs functions. This leadership committee meets quarterly to ensure that we have input and oversight from critical stakeholders into our cybersecurity program and evolving issues.

companyName: STRYKER CORP

ticker: SYK


text: Our cybersecurity risk management process, which encompasses continuous monitoring and periodic assessments, is designed to identify and mitigate cybersecurity threats and vulnerabilities. These efforts are aligned with the broader objectives of our ERM team and are continuously reviewed and refined in consultation with our Technology Risk Committee.

companyName: HERBALIFE LTD.

ticker: HLF


text: Our CISO and GIS team meets regularly with our IT and cybersecurity service providers and internal teams, such as the Risk Advisory Board (RAB), about the Company's ongoing compliance and risk management. GIS also drives business continuity and crisis management through coordinating and communicating with all levels of an organization and seeks to ensure that trends and emerging issues that could impact the business are considered and communicated as appropriate. Pursuant to our current policies the GIS team also provides, at the minimum, annual briefings to our Board of Directors and periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, among other relevant topics. The RAB convenes periodically or as needed to review the cybersecurity risks in the business. The RAB consists of individuals from GIS as well as the Chief Technology Officer.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Based on the Company's most recent assessments of cybersecurity risk, as of the date of this Form 10-K, we are not aware of any risk from cybersecurity threats that has caused or is reasonably likely to cause a material effect on the Company's business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor under the caption "Risks Related to our Intellectual Property, Information Technology, and Data Privacy" included in Part I, Item 1A. - Risk Factors" in this Form 10-K.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CISO who closely coordinates with the Company's Information Technology team. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Senior Leadership Team, including the CEO, CFO, CRO, Head of Legal, and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents. Annually, our incident response team performs exercises to simulate responses to cybersecurity events. Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Upon detection of a material cybersecurity threat, our Audit Committee receives an update from management of the cybersecurity threat, risk management and strategy processes, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our Audit Committee and board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

companyName: EXAGEN INC.

ticker: XGN


text: The ARC Committee reports to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board also receives briefings at least annually from management on our Information Security Program. Board members receive presentations on cybersecurity topics from our CISO and external experts from time to time as part of our continuing education to the Board on topics relevant to their service as a member of our Board.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. We maintain an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: We engage several third-party consultants in connection with our risk assessment and risk management, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: The Company's information security and cybersecurity program is managed by our CIO whose team includes a VP of Infrastructure and Director of IT Security (collectively, "the IT Security Team"), whom all have the necessary expertise, certifications and experience to lead our enterprise-wide cybersecurity strategy, policy, architecture and processes. The CIO has over 25 years of experience and has been a member and leader of our Company's information systems and technological advancements for the past 21 years. The Director of IT Security, reporting to our VP of Infrastructure, is responsible for our overall network security and assessing and managing cybersecurity risks and threats. The Director of IT Security has over 15 years of experience working in IT security and holds CISSP and GIAC certifications. The VP of Infrastructure reports to our CIO, and has principal responsibility for our network infrastructure and the operation of our cybersecurity program, network and system administration. The VP of Infrastructure has over 29 years of experience in system administration and has specialized in ERP systems and network infrastructure. Collectively, the IT Security Team prepares updates and presentations for the Board of Directors, Audit Committee and executive management.

companyName: H&E Equipment Services, Inc.


text: We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Onconetix, Inc.

ticker: ONCO


text: Vital aspects of our cybersecurity governance that are currently in process or have been implemented include the following: • Governance and Strategy: Management, the Audit & Risk Committee, and the Board ensure that our cybersecurity strategy is aligned with our business strategy. • Risk Management and Oversight: Our Audit & Risk Committee and the Board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated. • Resource Allocation: o Budget Approval: The Board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our incident response functions, which include our Security and Trust Organization ("S&TO") under the leadership of our Chief Security and Trust Officer, have established internal policies, processes, and procedures to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. We maintain policies and procedures for the escalation of cybersecurity incidents, assessed as potentially being or becoming material, to designated members of our senior management for further assessment. We also, as necessary, inform our independent registered public accounting firm of significant cybersecurity matters and any relevant developments.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Included in our mitigation strategy is a comprehensive cybersecurity insurance policy. The Board and Management recognize that cybersecurity matters, including expenditure related threats and the impact of incursions or breaches, may trigger disclosure requirements under SEC rules and regulations, and intend to remain vigilant with respect to the cybersecurity aspects of these obligations.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: A 24/7 monitored intrusion prevention system, internal intrusion detection system and firewalls to assist in the identification of unauthorized system access is in place. Network and application security reports are reviewed by Bank personnel and used to help in the detection process.

companyName: River Financial Corp

ticker: RVRF


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems and include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures in our effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: Cybersecurity is an integral part of the Board of Trustees', Audit Committee's and Corporate Governance and Nominating Committee's risk analysis and discussions with management. In February 2023, the Board of Trustees assigned cybersecurity oversight responsibility to the Corporate Governance and Nominating Committee via an amendment to the Committee's Charter. We also have a Cyber Steering Committee which works in conjunction with the Computer Incident Response Team ("CIRT") to develop strategies to mitigate risks and to address any cyber issues that may arise. The Cyber Steering Committee and CIRT are made up of certain executives, management, members of our information technology team and third-party advisors. The committees are led by our SVP, Chief Information Officer.

companyName: Urban Edge Properties

ticker: UE


text: We perform due diligence on select third-party vendors by collecting and reviewing certifications when available for our vendors. Certifications and reviews of third parties' security practices are no guarantee and of little assurance that a vendor will not suffer a breach or loss of Everi data. Along with due diligence efforts, we review vendor contracts for contractual controls, and to seek that legal recourse is available in cases of a breach and or data loss.

companyName: Everi Holdings Inc.


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with management and, if and when deemed appropriate by management or the Audit Committee, third party service providers, regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. We have completed various security audits and certifications, including SOC 2 Type II.

companyName: QUOTEMEDIA INC

ticker: QMCI


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer ("CIO") as part of our enterprise risk management ("ERM") process and through regularly scheduled meetings of our multidisciplinary cyber critical incident response team. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our "Cybersecurity Team").

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: We have developed a robust organizational structure to manage and oversee our information technology and cybersecurity programs, including full-time information security associates dedicated to cybersecurity. These individuals possess relevant experience and expertise in cybersecurity and risk management. Our Senior Vice President of Information Technology leads our information security, data privacy and protection, and information technology compliance programs. Guided by management, our information technology teams maintain a detailed Cyber Incident Response Plan ("CIRP") and hold frequent meetings to ensure the proper communication and execution of our security controls and procedures. The Senior Vice President of Information Technology regularly reports to and maintains ongoing dialog with our CEO, CFO and COO, and Board of Directors regarding our information security programs. This reporting includes updates on matters evaluated under our CIRP, the current threat landscape, cybersecurity initiatives, and the effectiveness of our cybersecurity programs.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled "The loss of personal, confidential, and/or proprietary information due to our cybersecurity systems or the systems of our customers, vendors, or partners being breached could cause us to incur significant legal and financial exposure and liability, and materially adversely affect our business, operating results and reputation," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TechTarget Holdings Inc.


text: Under the oversight and direction of the Akamai executive management team and the Audit Committee of Akamai's board of directors, the Chief Security Officer (the "CSO") has primary responsibility for overseeing Akamai's management of cybersecurity risks. Reporting to the Chief Executive Officer through the Company's Executive Vice President and General Manager of the Security Technology Group, the CSO leads Akamai's Information Security Committee, which works cross-functionally with other Akamai departments, including legal, business, policy and technical functions, as appropriate, to exchange information related to cybersecurity. Our current CSO is an accomplished security professional with 15 years of experience in building and leading information security teams at both public and private companies. Akamai's information security team is comprised of senior ranking staff who have experience in a broad range of security domains, including security operations, software security, risk management and auditing.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Role of Management We have an Information Security team that is led by our Chief Information Officer (CIO). Our CIO has led the Century Communities IT efforts since 2016, overseeing multiple acquisitions while modernizing the IT environment. He has held technology leadership roles in both the public and private sectors, with more than 20 years of experience as an IT leader in the homebuilding industry. In that time, our CIO has managed broad initiatives and teams, including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO reports to our Corporate General Counsel.

companyName: Century Communities, Inc.

ticker: CCS


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a dedicated cybersecurity risk management function, which is integrated as part of our overall enterprise risk management program. Our key cybersecurity risks include, among others, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; remote working environments; third-party risks; technology risks and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks.

companyName: Sabre Corp

ticker: SABR


text: The CISO leads the Information Security group within Information Technology, which manages the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for information technology security monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CISO and CIO together lead efforts to design, implement and operate controls deemed necessary, commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the organization. Our current CISO has a bachelor's degree in Computer Information Systems and a master's degree in Cybersecurity, and has over 20 years of experience building and executing information and cybersecurity strategies. Prior to joining CNA, our CIO served in a variety of roles at another major U.S. insurance company, both in business and technology, and has over 20 years of experience working with major U.S. Property & Casualty insurers.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: Cybersecurity represents a critical component of our overall approach to risk management. Accordingly, cybersecurity risks are subject to oversight by the Company's Board of Directors (the Board), primary responsibility for which has been delegated by the Board to its Operational Risk Committee (the Board Operational Risk Committee).

companyName: LendingClub Corp

ticker: LC


text: However, an actual or perceived breach of our security could damage our reputation, risk loss of our proprietary information and prevent us from attracting new clients, customers and/or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. We currently do not carry a cyber liability insurance policy.

companyName: American Clean Resources Group, Inc.

ticker: ACRG


text: We have a cybersecurity leadership team comprised of our Chief Information Security Officer, our Head of Infrastructure, and other senior leaders on our Information Technology group ("Cybersecurity Leadership Team"). Our Cybersecurity Leadership Team works with third-party service providers to help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our Cybersecurity Leadership Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services.

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: We may face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, which could adversely affect our business and operations. To identify and assess material risks from cybersecurity threats, we maintain a robust cybersecurity program to ensure our systems are effective and prepared for information security risks and have integrated these processes into our overall risk management systems and processes. We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, CIS, and COBIT, as well as by engaging experts to attempt to infiltrate our information systems. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools, services and capabilities, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling, disaster recovery and business continuity planning activities, red team testing, mandatory training for our employees, and tabletop exercises to inform our risk identification and assessment.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: In order to further protect ourselves financially, we maintain insurance coverage of up to $ 3 million with respect to losses from business interruption, data recovery, cyber-extortion and ransomware, data breach response and crisis management as a result of a cybersecurity incident.

companyName: FTC Solar, Inc.

ticker: FTCI


text: IBM's Enterprise & Technology Security ("E&TS") organization has oversight responsibility for the security of both IBM's internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks. E&TS also addresses cybersecurity risks associated with third party suppliers. For these purposes, E&TS includes a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM's internal systems. The CISO manages the CSIRT. The CISO also manages the Product Security Incident Response Team ("PSIRT"), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers. IBM also has Business Information Security Officers ("BISO") who coordinate with the Office of the CISO on security issues specific to particular business segments.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes or are reasonably likely to materially affect, the Trust, including its operations, results of operations, or financial condition.

companyName: SPDR GOLD TRUST

ticker: GLD


text: of Risks and Cybersecurity Governance combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, Valkyrie has identified the following risks that are present to its business as well as procedures to help mitigate those risks: Internal Threats There must be communication to employees on the detailed provisions of the cybersecurity program at onboarding and annually.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: We retain a Chief Information Consultant to collaborate with the company, including the Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us. We also use a third-party security management vendor to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: Audit Committee is responsible for oversight of our risk management with respect to information technology operations and cybersecurity and oversees risk management in the area of data privacy. As part of this process, the Audit Committee oversees the data protection and cybersecurity risk management program, which includes reviewing management's risk assessments and the steps management has taken to monitor or mitigate our cybersecurity risk exposure. Management regularly provides data protection and cybersecurity reports to the Audit Committee, which include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.

companyName: RBC Bearings INC

ticker: RBC


text: In 2023, the Company did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, the Company cannot eliminate all risks from cybersecurity threats, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors – Risks Related to Data Privacy and Information Security in this Annual Report on Form 10-K.

companyName: TIMKEN CO

ticker: TKR


text: We have not yet developed a cybersecurity risk management program, though we are in the process of assessing the potential risks. As of this time, we have determined that risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: South East Asia Development, Corp.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Fund. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund.

companyName: John Hancock Comvest Private Income Fund


text: The Company has an Information Technology ("IT") Risk Governance Program that aligns with the enterprise risk management framework and assists with fulfilling oversight responsibilities for major IT risks, including cybersecurity risks. The IT Risk Governance Program identifies, defines, manages, measures and governs cybersecurity risks across the Company at an enterprise level. The IT Risk Governance Program is carried out by an IT Risk Identification and Mitigation Team ("IT RIM"), which is comprised of business leaders from information security, information technology, human resources, internal audit, legal, and risk. The IT RIM meets monthly, reviews all cybersecurity incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a management level, and reports to the ERM Council.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: We utilize third-party software to provide continuous monitoring of our infrastructure and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is intended to prepare support teams in the event of a significant incident.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. The Cybersecurity Incident Response Plan, designed for our business environment, features the Director of IT and Operations as the incident coordinator. In the event of any suspicious activity or security breach, Energy Focus swiftly conducts an assessment to gauge the severity and scope of the incident, employing thorough investigation techniques to identify the root cause and affected systems. Immediate containment measures are then executed to prevent further unauthorized access or damage. Throughout the incident response process, transparent and timely communication is upheld with internal stakeholders and relevant external parties, ensuring alignment, and understanding of response efforts. Following successful mitigation and restoration of normal operations, Energy Focus conducts a comprehensive post-incident review to glean insights and lessons learned. These findings inform ongoing enhancements to our cybersecurity protocols, further bolstering our resilience against future threats. The incident coordinator oversees the detection, containment, and recovery procedures outlined in the plan. Effective communication protocols ensure timely notification to both internal and external stakeholders. Regular training sessions bolster staff preparedness, while post-incident reviews facilitate continuous improvement. Appendices offer essential contact information and tools necessary for incident response.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: The SVP, E&O provides updates to the Audit Committee at its quarterly meetings regarding management of the Company's cybersecurity matters, including any new cybersecurity threats, incidents, risks, risk management solutions, trainings or education, infrastructure upgrades, or governance changes.

companyName: Summit Midstream Corp

ticker: SMC


text: In the event of a cybersecurity incident, the Company has established an incident response plan to promptly and effectively address the situation. Cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for escalation to senior management and the Risk Oversight Committee ("ROC") of our Board of Directors, response and remediation. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.

companyName: Science Applications International Corp

ticker: SAIC


text: Vendors and service providers are rigorously vetted through a structured third-party risk management program. This process includes security assessments, contractual requirements for compliance with cybersecurity standards, and ongoing monitoring to ensure alignment with Astrana Health's security policies.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Company has implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to the Company's internal information systems and its services. The Board of Directors has direct oversight of the Company's risk management process and the management of cybersecurity risks. Under the direction and supervision of the Company's Chief Financial Officer, the Company conducts periodic risk assessments, which include cybersecurity risks. Senior management meets with the Board of Directors to review and discuss risk management on an annual basis. Management will provide a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant. The Company's Director of Technology, reporting to the Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats, and preparing updates for the Board of Directors. The Director of Technology has a combined twenty-one years of experience leading and working on cybersecurity teams at the Company and other companies in the oil and natural gas industry, has significant experience with networking, on-premises and cloud-based infrastructure, and cybersecurity controls, and has a Bachelor of Science degree.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Our cybersecurity risk management program is part of our overall enterprise risk management program and shares similar governance processes and reporting channels that apply across the enterprise risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: If our information technology systems or data, or those of third-parties upon which we rely, are or were compromised or experienced significant disruptions of our information technology systems or data security incidents, we could experience adverse consequences including but not limited to significant financial, legal, regulatory, business and reputational harm; litigation; fines and penalties;

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems, and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including our information security program, to assess their design and operating effectiveness. We provide regular and ongoing security education and training for employees and conduct recovery and resilience tests.

companyName: BayCom Corp

ticker: BCML


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting key vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: As part of its oversight function, the Board plays an active role, both as a whole and at the committee level, in overseeing management of YETI's cybersecurity risks. The Audit Committee has primary oversight responsibility for our overall enterprise risk assessment and risk management policies and systems, which includes risks related to our information technology and security systems, processes, and procedures, including risks related to cybersecurity threats. The Audit Committee receives quarterly presentations regarding our enterprise risk management program, including reports from our CIO and Director, Cyber Security, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures. These presentations address, among other things, the results of the most recent assessment or testing of our security information systems and our cybersecurity measures; the current threat environment; and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. Such quarterly presentations given to the Audit Committee are summarized and shared with the Board at its next meeting by the Audit Committee Chair. Outside of such quarterly presentations, senior leadership would be expected to update the Audit Committee and the Board in real time of incidents deemed material and requiring disclosure in a Securities and Exchange Commission filing or of other "critical" or "high" severity incidents (the highest severity tiers under our incident response plan) that in senior leadership's discretion require more immediate Audit Committee attention. In addition, the internal audit team provides quarterly cybersecurity updates to either the Audit Committee or the full Board regarding our risk analyses, assessments, risk mitigation strategies, and activities. As described above, management is responsible for our day-to-day risk management activities and identifies and manages areas of material risk, which includes information technology and security. Our CIO, who reports to our Chief Financial Officer, oversees our Information Technology and Cybersecurity teams, including the Director, Cyber Security. Our Chief Legal Officer oversees our Compliance team, which includes our Director, Technology Compliance. We believe that such cross-departmental involvement promotes a collaborative approach to protecting the Company's information systems from cybersecurity threats, detecting cybersecurity incidents and responding to cybersecurity incidents in accordance with our incident response plan. Through the practices and policies described above, including our incident response plan, our CIO, Director, Cyber Security and Director, Technology Compliance are informed about cybersecurity threats and incidents affecting our information systems and lead the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time. Incidents deemed "critical" or "high" are immediately escalated to the Chief Financial Officer, Chief Legal Officer, other senior leadership, and the Audit Committee.

companyName: YETI Holdings, Inc.

ticker: YETI


text: The CMAT assesses potential materiality of the confirmed or suspected security incident based on the actual or anticipated potential impact to the Corporation's results of operations, financial position and cash flows; operations including disruptions and downtime; strategic plans; confidential information; employee and community health and safety; customers and vendors; investors; regulatory compliance; and reputation.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: We maintain business continuity plans that define how our critical operations will continue during disruptions, ensuring minimal downtime and seamless access to vital services. Our comprehensive disaster recovery plans include regularly testing backup systems and clear procedures for restoring critical business applications in the event of data loss, cyberattacks, or natural disasters. This multi-faceted approach ensures that, even in the face of unexpected incidents, our subsidiaries and organization can quickly recover, maintain operational resilience, and protect the data and services that are essential to our success.

companyName: ARGAN INC

ticker: AGX


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure related to cybersecurity risks, and our executive officers are responsible for the day-to-day assessment and management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Audit Committee.

companyName: VACCINEX, INC.

ticker: VCNX


text: We have implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Xencor Inc

ticker: XNCR


text: Our Board of Directors is responsible for overseeing our cybersecurity risk management and strategy. Our President regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: UNITED GUARDIAN INC

ticker: UG


text: Management Committee Oversight The Company has established an Information Risk Management Subcommittee, chaired by the Chief Information Security Officer and supported by leaders from departments across the Company. The Cybersecurity function is provided by qualified financial service technology professionals, with extensive certifications and/or advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The subcommittee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the Enterprise Risk Management Committee to provide an additional second line review in alignment with Enterprise Risk functions. All Information Security activity is lead by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting cyber security matters to the Board. The Chief Information Security Officer has many years of experience leading cybersecurity governance and operations in financial services, supported by staff cybersecurity specialists. Management provides cybersecurity statistics and details to the Board quarterly.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at required new employee orientation and subsequently receive information security tips via email each business day. Employees also receive monthly security awareness video training and are required to complete annual computer-based training. The Company also provides information security awareness training to business customers and individuals in our communities.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: AUTONATION, INC.

ticker: AN


text: The Company's Chief Technology Officer, Chief Operating Officer, and Technology Consultant are primarily responsible for assessing, monitoring and managing our cybersecurity risks. Our Chief Technology Officer must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. The Chief Technology Officer provides briefings on cybersecurity threats and related risks to our Chief Executive Officer on a regular basis. Our Chief Technology Officer has nine years of experience in the field of information technology. The Chief Technology Officer oversees and tests our compliance with standards, remediates known risks, and leads our employee training program. The Company's Chief Technology Officer and Technology Consultant have extensive experience in cybersecurity and possess the necessary knowledge, skills, background, and experience.

companyName: Strive, Inc.

ticker: ASST


text: g.run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and h.carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Inhibrx, Inc.