text: Our cybersecurity awareness program includes regular phishing simulations, and quarterly general cybersecurity awareness and data protection modules for all employees with network access, as well as more contextual and personalized modules for targeted users and roles. We complete annual internal security audits and vulnerability assessments of the Company's information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We have also purchased network security and cyber liability insurance in order to provide a level of financial protection, should a data breach occur. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: Our cybersecurity risk management program includes: physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third -party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;

companyName: CREATIVE REALITIES, INC.

ticker: CREX

secItem: Item 1C


text: The cybersecurity risk management framework also establishes standards or controls for the design of our cybersecurity infrastructure, including with respect to monitoring and preventing cybersecurity incidents, authenticating the identity of persons authorized to access critical information resources, and assessing safeguards that must be implemented by our external vendors and service providers.

companyName: OFG BANCORP

ticker: OFG


text: The Company acknowledges that an actual or perceived breach of its information assets could damage its reputation, interfere with the progress of clinical trials, or interfere with efforts to pursue regulatory approvals for its product candidates. The Company also recognizes that an actual or perceived breach of its information assets could impact the Company's business strategy, operations, or financial condition, as well as subject Actinium to third–party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect the Company. For further information, see "Risk Factors—Our business is subject to cybersecurity risks" in Item 1A of this Annual Report on Form 10–K.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, assessment or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.

companyName: MCKESSON CORP

ticker: MCK


text: We have an IRP that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for investigations designed to help us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: We, like other technology companies operating in the current environment, have experienced cybersecurity incidents, but in the last three years we have not experienced an incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: We do not believe that any risks we have identified from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For additional information regarding cybersecurity risks we are subject to, refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: HTLF has not been materially affected by any cyber security incidents to date, nor are we aware of any cyber security incident which we believe would have a material impact on us in the future. Nevertheless, like all financial institutions, we are subject to the risk that cybersecurity threats will continue to evolve and may materially impact us in the future. These factors are further detailed in the "Risk Factors" section included under Item 1A of Part I of this Annual Report on Form 10-K, including under the caption "Security breaches, cyber-attacks or other similar incidents with respect to our or our vendors' systems or network security, as well as the resulting theft or compromise of business and customer information, including personal information, could adversely affect our business or reputation, and create significant legal, regulatory or financial exposure."

companyName: HEARTLAND FINANCIAL USA INC


text: We have a cybersecurity third-party risk management program, which is an evolving, cross-functional program to help assess and mitigate risks from third-party vendors and other service providers. Our cybersecurity team also uses several layers of defense and protection technologies, cybersecurity experts, and automated alerting and response mechanisms to reduce risk to Enbridge.

companyName: ENBRIDGE INC

ticker: ENB


text: We have an information security process integrated into our overall enterprise risk management (ERM) process that is designed to identify, assess, and manage material risks and threats from cybersecurity. To protect our information systems against cybersecurity threats, we employ a range of security processes designed to identify, prevent, detect, respond to, and recover from identified vulnerabilities and cybersecurity incidents in a timely manner. These include internal reporting mechanisms, monitoring solutions, and detection tools. We also leverage the expertise and support of key cybersecurity third-party partners and tools. Our protective measures include technical and organizational safeguards, employee training, incident response capability assessments, cybersecurity insurance, and business continuity mechanisms. We perform employee training as part of our information security processes for all employees. We regularly assess cybersecurity risks and technology threats, utilizing a qualitative risk model to identify, measure, and prioritize certain risks, and develop related security controls and safeguards.

companyName: VSE CORP

ticker: VSEC


text: Our IT security management team, led by our Chief Technology Officer, reports quarterly in meetings to our Audit Committee and periodically to our Board of Directors regarding updates to our cybersecurity program and related risks. We have a cybersecurity expert on the Board of Directors and its Audit Committee to provide expanded expertise and oversight on our cybersecurity processes and systems. Topics in the meetings include discussion of the company-wide cybersecurity strategic roadmap and risks, protocols to mitigate such rusks, and the progress of initiatives in the cybersecurity program. Specific cybersecurity briefing areas may include topics such as security, infrastructure, cybersecurity tooling/applications, and compliance.

companyName: CarParts.com, Inc.

ticker: PRTS


text: The General Partner uses both internal and external auditors for cybersecurity services. The General Partner maintains an Information Security Steering Committee chaired by Man Group's chief information security officer ("CISO") and which contains, among other members, Man Group's chief technology officer ("CTO"). The CISO is a Certified Information Systems Security Professional ("CISSP") and has over a decade of experience in the fields of technology and security. The General Partner utilizes a Security Operations Center ("SOC") model and annual reports to prevent, detect, and respond to cybersecurity incidents. The General Partner has regular cybersecurity audits conducted by KPMG. Further, the General Partner contracts third parties to perform quarterly phishing testing, annual penetration tests, and a bi-annual red team exercise. These exercises consist of virtual simulations of cybersecurity incidents in order to test the effectiveness of the General Partner's cybersecurity protection program. The exercises also help prepare the General Partner and Partnership to sufficiently respond in the instance of cybersecurity incidents. The General Partner also has a dedicated compliance function that focuses on the General Partner's international operations in order to comply with international cybersecurity laws. The General Partner uses these processes as well as the RCSA and CIRP to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The Company conducts periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Star Holdings

ticker: STHO


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.

companyName: ThredUp Inc.

ticker: TDUP


text: The ACT, in consultation with the ELT and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent EGS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our cybersecurity program. The results of this assessment, which are reported to the board of directors, assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: QXO, Inc.

ticker: QXO


text: To continually evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework, has external experts complete assessments of Centrus' cybersecurity posture, completes internal self-assessments and engages with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: As of the date of this Annual Report on Form 10-K, we have not implemented formal processes to oversee and identify risks from cybersecurity threats associated with our use of third parties. We are working toward the implementation of a third-party risk management program. We believe that this program will better enable us to identify and manage material risks from cybersecurity threats related to our third-party service providers.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly interacts with the Company's General Counsel, ERM committee, the Sr. Director, IT, and executive leadership. The ERM committee is a cross-functional team of high-level leaders that meet at least quarterly to anticipate, identify, prioritize, and manage material risks to the Company's strategic objectives. It conducts an extensive bi-annual survey and interview process to identify the material risks, and it continues to monitor for any emerging material risks between surveys. The ERM Committee reports on its findings and activities twice annually to the Audit Committee of the Board.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: 4.Remediation and Escalation: In the event that cybersecurity risks or deficiencies are identified within our third-party vendor ecosystem, we work collaboratively with the vendor to address and remediate these issues in a timely manner. Depending on the severity of the risk, we may escalate concerns to senior management or terminate the vendor relationship if necessary.

companyName: NewtekOne, Inc.

ticker: NEWT


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives (i) quarterly updates or reports delivered directly from our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") and (ii) three reports delivered as part of the Company's enterprise risk management update to the Audit Committee. These reports may be supplemented, as needed, by the CIO, CISO, and other executives at the Company. These reports include a variety of cybersecurity topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks. In such sessions, the Audit Committee receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our CIO and CISO.

companyName: JUNIPER NETWORKS INC


text: We maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps us inform our cybersecurity agenda and prioritize our cybersecurity activities. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Since the beginning of the last fiscal year, we have not identified any cybersecurity threat or incident that has materially affected the Company or our financial position, results of operations and/or cash flows, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. We continue to invest in the cybersecurity and resiliency of our networks and enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors" included in this Annual Report.

companyName: Zevia PBC

ticker: ZVIA


text: We have cyber incident response plans to manage significant cybersecurity incidents across different aspects of our operations. Cybersecurity incidents are escalated based on significance to our Chief Administrative Officer, Chief Nuclear Officer, Chief Fossil Officer, General Counsel, Chief Financial Officer, Chief Executive Officer, Audit Committee, and (or) Board of Directors.

companyName: Talen Energy Corp

ticker: TLN


text: We mitigate cyber risk by maintaining an enterprise security program based on the National Institute of Standards and Technology Cyber Security Framework. This program includes trainings and exercises at all levels of the Company. Our security program incorporates enterprise business continuity which facilitates a business impact analysis of core functions for development of emergency operating and disaster recovery plans and coordinates annual testing and training exercises. In addition, there are independent third party and regulatory audits of our security program.

companyName: AVISTA CORP

ticker: AVA


text: Cyberthreats in the election industry are constantly evolving and becoming increasingly difficult in detecting and successfully defending against them. Threat actors, including individual and groups of hackers and sophisticated organizations, including nation-states, state-sponsored organizations, or cybercriminal groups, can pose a threat to GES customers and GES election software infrastructure. Threat actors may also utilize emerging technologies, such as AI and machine learning. Our current capabilities may not detect certain vulnerabilities successful cyber intrusion could result in significant business disruption, reputational damage, regulatory penalties, and financial loss. GES maintains cybersecurity insurance, employs robust monitoring tools, and conducts employee training, but these safeguards may not prevent all incidents. Failure to effectively prevent or respond to such incidents could materially and adversely affect the Company and businesses operations and financial condition.

companyName: Global Arena Holding, Inc.


text: Although, through the date of this filing, we are not aware of any cybersecurity incidents that have materially impacted the Company, we cannot eliminate all risks from cybersecurity threats. We describe whether and how risks related to cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A of this Annual Report on Form 10-K.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: Our IT team, which includes both our internal staff and retained consultants with IT and cybersecurity expertise, is led by our executive director of IT. The IT team has responsibility for, among other things, developing and implementing practices, procedures and controls designed to identify, assess and manage cybersecurity programs and risks. The IT team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our IT team is supplemented by a security committee, comprised of representatives from key functional areas of our business and includes both our CFO and our Sr. VP of Human Resources to whom the executive director of IT reports. Combined, members of our security committee and our internal IT team have more than 25 years of risk management experience, including with respect to IT and cybersecurity systems.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: ensuring that our policies, processes, practices and technologies proactively protect, shield, defend and remediate cyber threats; and delivering quality communications and annual training to stakeholders on cyber awareness and computing hygiene.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: We have integrated cybersecurity related risks into our enterprise risk management program, which is designed to identify, prioritize, assess, monitor and mitigate the various risks confronting our Company, including both external and internal cybersecurity risks. When identified, risks are reported to relevant business and governance leaders within the Company for appropriate action. When potential improvements are identified, we weigh the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.

companyName: HOLOGIC INC

ticker: HOLX


text: We are managed and operated by the board of directors and executive officers of MPLX GP, our general partner and a wholly owned subsidiary of MPC. Our general partner has the sole responsibility for providing the employees and other personnel necessary to conduct our operations, including processes for the assessment, identification and management of material risks from cybersecurity threats.

companyName: MPLX LP

ticker: MPLX


text: The Company employs a constantly evolving, defense-in-depth methodology to cybersecurity. Robust high-availability firewalls are in place at the perimeter. Remote workers are supported through the Company's secure VPN and uses multifactor authentication. The Company has a vulnerability management program in place that includes a managed detect and response platform to ensure monitoring of the Company's network, ensures the timely installation of software patches, and provides a risk-based approach to addresses vulnerabilities across the network. Network security controls are in place to prevent unauthorized access to the network or the Company's IT resources. The Company employs controls over its managed workstations, servers, and other endpoints to prevent inappropriate access or damage to physical, virtual, or data assets. Data loss prevention programs are in place to prevent the inappropriate transmission or exposure of sensitive data assets or customer information.

companyName: FIRST BANCSHARES INC /MS/


text: Our CISO, and where appropriate our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of identified cybersecurity incidents, through our security incident response process. We maintain internal and external channels and signals to receive reports of cybersecurity or privacy threats or incidents. A reported incident triggers our Security Incident Response Policy or associated plans, which has defined roles for our cross-functional incident response team to investigate, contain, eradicate, and remediate the incident. The incident response team assesses the severity and priority of reported incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team by our CISO and General Counsel (or their designees) and escalations of certain cybersecurity incidents as appropriate to our board of directors. If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.

companyName: Snap Inc

ticker: SNAP


text: Independent Audit and Testing. The Company's Audit Department schedules and oversees a regular review of program design and effectiveness by independent third-party audit firms that specialize in technology and cybersecurity. Results are reported directly to senior management and the Audit Committee of the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and the Company's information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of the Company's information systems around-the-clock, including intrusion detection and alerting. • A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: Enterprise Risk Management Gulfport increasingly relies on digital technology to optimize our business. As our reliance on technology expands, we are exposed to additional cyber-risks, which we focus on assessing, identifying, and managing. These risks include, but are not limited to: financial risks, operational risks, safety concerns, employee and owner personal information and violation of data privacy or security laws.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Oversight and Governance The Board of Directors has oversight of the Company's cybersecurity program and has delegated the quarterly assessments and management of cybersecurity risks to the Audit Committee.

companyName: ThredUp Inc.

ticker: TDUP


text: To address risks associated with third-parties, Prudential Financial has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.

companyName: PRUCO LIFE INSURANCE CO


text: Coalition Control monitors and detects risks across our entire external digital footprint, including assets, apps, services, and data leaks. The tool shows us where any potential vulnerabilities are identified and how to fix them.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks In the ordinary course of business, our information systems on which we run our business operations and store confidential or proprietary data, such as PII about our customers and our employees, are subject to potential cyber-attack. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or compromise to our IT systems. We have implemented security measures that are designed to detect and protect against cyberattacks. Our processes and procedures align with the National Institute of Standards and Technology Cybersecurity Framework. I n particular, we seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities; • cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer; • cybersecurity awareness training for employees; • security tools in our system to monitor and detect cybersecurity threats; • cyber liability insurance; • a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and • a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.

companyName: Owlet, Inc.

ticker: OWLT


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to us and the Adviser.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: As a professional services firm that processes confidential and sensitive information, such as personal information, cybersecurity risk management is an integral part of our enterprise risk management strategy. Our cybersecurity risk management program has been designed based on industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework and ISO/IEC:27001, and provides a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with our use of services, applications and products provided by third-party vendors and service providers.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security control, as well as processes to oversee and identify any cybersecurity risks associated with our use of third-party service providers;

companyName: 374Water Inc.

ticker: SCWO


text: Our Vice President and Chief Information Officer (CIO), who has over two decades of experience in information technology, is responsible for overseeing our cybersecurity program. The CIO oversees an IT Information security team responsible for our overall cybersecurity program. This team is comprised of several IT professionals with varying degrees of cybersecurity experience and is led by our Director – Cybersecurity who has over 30 years of experience in information technology and cybersecurity. The Director – Cybersecurity reports to the CIO, who reports to the Senior Vice President and Chief Financial Officer.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: We conduct regular assessments of cybersecurity risks to identify threats to us and potential vulnerabilities that could negatively affect our business operations if exploited. We track cybersecurity risks within our enterprise risk management system with cybersecurity threats considered to be among the top-priority risks to us. In addition, our Enterprise Security Organization (the "ESO") conducts technical risk assessments, and, in some instances, we engage with third-party experts to assist with or perform technical risk assessments. The results of these risk assessments are reported to management. Our processes require escalation of significant cybersecurity risks to management and Paychex's Audit Committee derived from the Board of Directors (the "Board").

companyName: PAYCHEX INC

ticker: PAYX


text: Company has retained outside consultants to assist with information technology activities and has put in place governance measures for information security with a focus on continuous improvement of its systems. This includes control requirements for change management, patching processes, the implementation of multifactor authentication, comprehensive data backup strategies, and continuous security monitoring. Additionally, management continues to enhance our security controls, with any significant issues promptly reported to the Audit Committee.

companyName: EXOZYMES INC.

ticker: EXOZ


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats. We have a special email encryption from Google that protect against cyberthreats.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks. This process is supported by both management, as well as our Board of Directors and our Science and Technology Committee. The current chair of our Science and Technology Committee is a National Association of Corporate Directors ("NACD") certified cybersecurity expert.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: In response to the increasing threats presented by cyber incidents, in April 2022 the Company established a Cybersecurity Committee, which meets regularly. This committee is comprised of the Director of Technology, members of management from the technology, quality, health, safety and environment and operations departments, as well as the Chief Financial Officer and the General Counsel, both of whom report to the Chief Executive Officer. The Cybersecurity Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Committee develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors and receives regular updates on cybersecurity-related matters.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: We engage an IT consultant in connection with our risk assessment processes. This consultant assists us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. Our oversight over our IT consultant allows us to ensure it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect the Company.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances and incident severity, including our Executive Director Information Technology who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents. In addition, the Company's incident response process includes reporting to the audit and technology steering committees of the board of directors for certain cybersecurity incidents.

companyName: MACROGENICS INC

ticker: MGNX


text: Our information security team is led by our Senior Vice President, Chief Technology Officer ("CTO") and our Vice President, Information Security, who together have over 36 years of technology industry experience and expertise in information security, cybersecurity, and distributed systems. This team is responsible for our information security program and protocols, including managing and coordinating efforts to prevent, mitigate, detect, and remediate cybersecurity incidents, and escalating significant security risks or incidents to executive management.

companyName: Coursera, Inc.

ticker: COUR


text: Risk assessment and oversight are an integral part of our governance and management processes. The Board has ultimate oversight of the Company's risk management. In accordance with its charter, the Audit Committee of the Board is responsible for overseeing our enterprise risk management program on behalf of the Board, including material risks related to cybersecurity threats, and reporting on these matters to the Board. The Audit Committee receives regular updates from management, including the information technology and legal teams, on cybersecurity risk resulting from risk assessments and reviews any information on relevant internal and industry cybersecurity incidents and is notified between such updates relative to any incidents which could materially affect the Company. Based on this information, our Audit Committee monitors the Company's cybersecurity program, including potential threats, weaknesses and vulnerabilities, and reviews the policies and procedures in place to prevent, detect and respond to cybersecurity threats and unauthorized access to our information security systems. Significant findings related to cybersecurity, data and technology risks or incidents are regularly reported to and discussed at the Board level. Three members of our Board, two of which are Audit Committee members, have received certifications in cyber-risk oversight through the National Association of Corporate Directors.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Role of the Board The Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the sensitive data and protecting the perimeter of the computer network. The Board is responsible for overseeing overall risk management for the Corporation, including review of the cybersecurity program. As part of its oversight responsibilities, the Board receives an annual cybersecurity update from the Chief Financial Officer. The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, such as updates to Aemetis' cybersecurity programs and mitigation strategies, and other cybersecurity developments.

companyName: AEMETIS, INC

ticker: AMTX


text: Network Security – The Company employs a "defense in depth" strategy to secure our networks, servers, and data. Our critical networks utilize redundant components and connections to ensure high availability, reliability, and performance. We implement a security architecture based on zero trust principles, establishing rules for segmentation and access control that consider risk and business impact. This approach encompasses infrastructure, applications, and data in the cloud.

companyName: CINCINNATI BELL INC


text: Our information security program is focused on detecting, identifying, defending against and mitigating the effect of cybersecurity risks to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.

companyName: Simply Good Foods Co

ticker: SMPL


text: Our Chief Technology Officer ("CTO") is responsible for cybersecurity within our company, including information technology risks, controls, strategies and procedures. The Cybersecurity Subcommittee of the Board of Directors oversees cybersecurity for our company and meets with the CTO at least quarterly to discuss the status of cybersecurity efforts as well as any security incidents. Cybersecurity Subcommittee materials are provided to the Audit Committee as well as the full Board of Directors. The members of the Cybersecurity Subcommittee brings at least 40 years of expertise and executive-level experience in information technology and cybersecurity to successfully support the CTO to maintain strong a cybersecurity strategy within our company. The Board of Directors believes that a strong cyber strategy based on industry accepted best practices is vital to protect our business, customers and assets.

companyName: JOINT Corp

ticker: JYNT


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a result, we have integrated cybersecurity risk management into our broader risk management framework to promote a holistic approach toward assessing, identifying, and managing material risks associated with cybersecurity threats. This integration ensures that cybersecurity considerations are an integral part of the decision-making processes at every level of our organization.

companyName: Piedmont Lithium Inc.


text: Our Board of Directors, in coordination with our Audit Committee, oversees our risk management program, including the management of cybersecurity threats. Our Audit Committee receive quarterly updates on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties.

companyName: Eiger BioPharmaceuticals, Inc.


text: The Bank's ability to respond to security incidents in a planned and coordinated fashion is important to the success of its information systems security program. The IRP has been developed to provide protections for both the Bank and the Bank's customers and to mitigate the negative effects of cybersecurity events or security breaches on the Bank itself. Program also identifies the Bank's Information Security Incident Response Team (ISIRT) Policy and program procedures which are tested annually.

companyName: River Financial Corp

ticker: RVRF


text: Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by or themselves include governmental actors with significant means. We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. The Company experiences cyber threats in the normal course of its business, and computer viruses, hackers, employee misconduct and other external hazards could expose our information systems to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. Refer to Item 1A. Risk Factors, for additional details on cybersecurity risks that could potentially materially affect the Company.

companyName: USA Rare Earth, Inc.

ticker: USAR


text: The Company's cybersecurity program is overseen by its Chief Information Security and Privacy Officer (the "CISO"). The Company's CISO has over 20 years' experience in the information security industry, including a previous CISO position at a large global conglomerate based internationally, and as head of product security for a US-based large global conglomerate. The Company's CISO also has previous financial services experiences as head of cyber defense for a large regional bank. The CISO meets quarterly with and chairs the Cyber ERM Committee, which consists of representatives from the officer of enterprise security, information technology, risk, compliance, and other internal stakeholders, and presents quarterly to the Enterprise Risk Management Committee ("ERMC"), which includes executive and senior leadership of the Company, and the Risk and Compliance Committee of the Board of Directors ("Board Risk Committee"). The management of risk from cybersecurity threats is one of the risks that is continuously assessed, monitored and managed by the Company under the Company's ERM framework which is described more fully in the Company's Annual Report to Shareholders. The CISO maintains a scorecard which monitors and measures various cyber risks, including: a. Operational capability, including cyber defense, vulnerability management, and third-party risk management. b. Risk assessments, including GLBA assessments and attack simulations. c. Program maturity, including MITRE and the Federal Financial Institutions Examination's Council's maturity framework. d. Internal and External Audit, including external assessments, internal audit results, and regulator exam results.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: Material Impact of Cybersecurity Risks Cybersecurity threats have the potential to disrupt manufacturing operations, compromise sensitive data, or lead to regulatory penalties. Our proactive risk management processes are designed to minimize the likelihood and impact of such events. As described below, we did not experience cybersecurity incidents in the fiscal year ended December 31, 2024.

companyName: Quality Industrial Corp.

ticker: QIND


text: These include monitoring and detection programs, network security measures, firewall monitoring devices and multi-factor authentication which are all overseen by our IT Director, who possesses the necessary expertise to implement the appropriate tools and processes to effectively manage cybersecurity risks. With over 30 years of experience in the oil and natural gas industry, our IT Director has 12 years of cybersecurity experience where he has led several teams introducing cybersecurity initiatives and implementing robust frameworks are actively assessing the technological risks to our key IT systems and information and are implementing controls to identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an understanding of access controls, a records and information management policy, change control procedures, risk and control registry, and configuration standards.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Risks from Cybersecurity Threats For a description of the cybersecurity risks which could materially affect Prosper's business strategy, results of operations, or financial condition, please refer to the following: (i) "Risk Factors—If the security of PFL's investors' and borrowers' confidential information stored in our systems is breached or otherwise subjected to unauthorized access, users' secure information may be stolen, our reputations may be harmed, and we may be exposed to liability,"; (ii) "Risk Factors—Any significant disruption in service in our marketplace or in PMI's computer systems could adversely affect PMI's ability to perform its obligations under the Administration Agreement,"; and (iii) "Risk Factors—Our marketplace may be vulnerable to malware, third-party software vulnerabilities, and similar disruptions." We and certain third party vendors occasionally have experienced cyber-attacks, breaches of our and their systems and other similar incidents, which to-date have not had a material effect on Prosper's business strategy, results of operations, or financial condition.

companyName: PROSPER MARKETPLACE, INC


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and includes it as part of the full Board's oversight function. The full Board is updated on cybersecurity risks and compliance with relevant standards and regulations as part of its overall governance responsibilities, including quarterly Board meeting reports. Our Director of IT, who is responsible for the oversight and implementation of the cybersecurity program, also periodically makes presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company. Additionally, we have an escalation process to inform the Board of high-severity cybersecurity incidents that may occur. Our Board also periodically engages independent third-party technology experts to test our information technology systems, including cybersecurity.

companyName: Genasys Inc.

ticker: GNSS


text: Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our AVP Logistics, Systems & IT is responsible for managing our outside technology services and has over 10 years of relevant experience. The AVP Logistics, Systems & IT reports directly to our Chief Financial Officer and reviews cybersecurity assessments with our Chief Financial Officer on a regular basis. Our Chief Financial Officer is responsible for escalating any cybersecurity matters as appropriate. The Audit Committee of our board of directors will regularly review cybersecurity requirements and risks on a quarterly basis.

companyName: CV Sciences, Inc.

ticker: CVSI


text: The Company's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with input from our Board of Directors, proactively manages the Company's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Company has appointed a Chief Information Officer ("CIO") to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. This includes regular consultation with external cybersecurity experts. In addition, we participate in external tabletop exercises on a regular basis in addition to conducting our own internal tests of our systems. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: Within our cybersecurity program, we have identified and implemented a variety of processes for cybersecurity risk management: • We conduct regular risk assessments to identify and evaluate potential cybersecurity threats, including threats to our business operations, technology infrastructure, and data. • We monitor threat intelligence feeds to stay updated on the latest cybersecurity threats and vulnerabilities. • We scan our systems for vulnerabilities on an ongoing basis, with vulnerabilities prioritized and remediated based on their potential impact. • We have implemented a variety of access controls to restrict access to our systems and data, including user authentication, authorization, and encryption. • We conduct regular security awareness training for our employees to help them identify and avoid cybersecurity threats. • We periodically conduct test exercises to review our cybersecurity controls and resilience and to identify improvements. • Our third-party risk assessment program identifies, assesses, and monitors vendors for risk. These include information technology and cybersecurity vendors who are part of our digital supply chain.

companyName: Western Union CO

ticker: WU


text: We frequently collaborate with other third-party service providers to conduct regular audits, threat assessments, and consultation on cybersecurity strategy, enhancements, and best practices. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel, cybersecurity software providers, and penetration testing firms.

companyName: Tempus AI, Inc.

ticker: TEM


text: The Board and Audit Committee, in conjunction with their oversight responsibility related to the ERM process and management, participates regularly in discussions with management regarding cybersecurity risks, and performs a review at least annually of the Company's cybersecurity program. This includes discussions of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: Significant information technology processes that have been implemented include: - vulnerability management to help ensure security updates are effectively applied, - utilization of encryption and multi-factor authentication technologies to protect company data, - regular required training for all employees with systems access regarding matters such as cybersecurity threats and data protection, and utilization of simulated phishing tests to increase security awareness, - regular review of third-party service providers, including review of their system and organization controls (SOC) reports, - enhanced monitoring capabilities for early detection and rapid response to potential security anomalies, - documented incident response readiness process updated annually, - completion of tabletop exercises on potential cybersecurity breaches with the assistance of a third-party cybersecurity consultant, and - regular review of information technology disaster recovery and business continuity processes to help ensure the ability to resume work after an incident.

companyName: NVR INC

ticker: NVR


text: We have also implemented the following protective and preventative measures: • identity management and access control safeguards; • encryption of data in transit and at rest; • system and network security and monitoring; • information protection and governance; and • ongoing systems and equipment maintenance.

companyName: Texas Pacific Land Corp

ticker: TPL


text: The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: The Company's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with information technology, legal and compliance personnel of the Adviser.

companyName: Stone Point Credit Corp


text: We are currently a shell company with no business operations. Since May 2019, we have been in search of a suitable merger or acquisition candidate. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board of Directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any.

companyName: NON INVASIVE MONITORING SYSTEMS INC /FL/

ticker: NIMU


text: Our Chief Information Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer has nearly four decades of overall information technology experience in secure environments, including eight years of infrastructure and cybersecurity leadership at our Company. Furthermore, our Strategy Committee Chair brings nearly four decades of technical and organizational leadership experience, having previously held senior US government positions as the Principal Deputy Director of National Intelligence and the Senior Advisor to the Director for Cyber and Director of Information Operations for the CIA, where she was responsible for cyber operations, foreign cyber threat assessment, and cybersecurity. She sits on the boards of several public and private technology companies, filling the role of their cybersecurity expert.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: Related to Cybersecurity Risks Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: TREVENA INC


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Director of Information Technology leads an internal team and works directly with our third-party information security professionals to manage our cybersecurity risk management program and activities. This includes monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies.

companyName: BROADWIND, INC.

ticker: BWEN


text: The Information Security Governance Council ("ISGC") acts on the behalf of and to assist the Board of Directors and executive management in fulfilling its oversight responsibilities regarding the Bank's information security programs and risks. The ISGC is comprised of members from Risk, Information Technology, and other strategic areas within the Bank, including the CIO, and meets at least quarterly. The responsibilities of the ISGC include providing strategic oversight and implementation guidance for the ISP, aligning cybersecurity and business objectives, monitoring and reporting on cybersecurity and information security incidents, and promoting a strong culture around information security.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party service providers, including those in our supply chain and those who have access to our customer or employee data or our systems. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.

companyName: Workday, Inc.

ticker: WDAY


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to our disclosure committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with these materiality assessments and any resulting reporting requirements.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: CORETEC GROUP INC.

ticker: CRTG


text: Our current cybersecurity risk assessment program consists of an annual review of our risks and policies. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats. We have security measures in place to protect our clients, customers, employees, and vendor information and prevent data loss and other security breaches. We also only use third party software for accounting, billing and payroll that have successful SOC 1 type 2 compliance. In addition, we maintain business continuity, contingency, and recovery plans for use in the event of a cybersecurity incident by the administering of have multiple controls and processes in place in order to assess risks and to prevent breaches, some of which include: subscribing to a cybersecurity risk management program;

companyName: Loop Media, Inc.

ticker: LTPVQ


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: GENELUX Corp

ticker: GNLX


text: We have implemented the Three Lines of Defense Model as the foundation of our risk management approach. Our information security team serves as a First Line, working with our Enterprise Risk Management & Compliance functions as a Second Line, and our Internal Audit function as the Third Line.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: In addition, the Audit Committee receives regular reports on cybersecurity matters from the Chief Information Officer (CIO) and the CISO. The Board of Directors is also updated by the CIO and CISO on a periodic basis. Our CIO, who reports directly to the President and CEO, has over 30 years of leadership experience in technology-based roles across multiple industries. Our CISO, who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 25 years of information technology experience, with more than 15 years of Information Security specialization. Our CISO is responsible for understanding, managing, and communicating cybersecurity risks internally to our management (including the Enterprise Risk Committee on which he serves), and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: H&R BLOCK INC

ticker: HRB


text: Our cybersecurity incident response and vulnerability management plans are designed to escalate certain cybersecurity incidents to members of leadership depending on the circumstances. In these situations, members of our leadership team work with our incident response team to help us evaluate, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management plans include reporting to the Audit Committee (who may consult with our technology committee) for certain cybersecurity incidents.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Our CISO has served in that position since 2018. Our CISO has extensive experience serving in executive and senior IT leadership positions over the past 25 years including eleven years at Cavium in a succession of information technology roles, including vice president of business systems, two years at ServiceNow as vice president of IT Applications, and eight years overseeing worldwide IT infrastructure, IT operations and information security at Pinnacle Systems.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including: • periodic briefings from internal security personnel; • periodic reviews of risk management measures implemented to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, including our incident response plan; • threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and • alerts and periodic reports produced by security tools deployed in our IT environment.

companyName: Bloom Energy Corp

ticker: BE


text: We require periodic cybersecurity training for our employees to learn about data security, how to identify and mitigate potential cybersecurity risks and how to protect our resources and information. Members of the risk management, cybersecurity and technology teams receive specialized training about evolving cybersecurity threats and new risk mitigation and detection technologies.

companyName: California BanCorp


text: Our cybersecurity program includes the following key elements: • Enterprise Risk Management ("ERM") process to identify and prioritize cybersecurity risks. • Strong cybersecurity program that conforms to the National Institute of Standards and Technology framework, including a zero-trust model, monitoring, and threat intelligence. • Cybersecurity awareness training program to educate employees about risks and how to detect malicious attack attempts. • Cybersecurity Incident Response plan that is tightly integrated with the Global Crisis Management Plan to effectively respond and recover from material incidents. • Risk-based security architecture designed to protect our most critical assets from the most common threats. • Maintenance of a cybersecurity insurance policy.

companyName: Arcadium Lithium plc


text: Our cybersecurity risk management strategy processes, discussed in greater detailed above, are led by our Chief Financial Officer, in conjunction with our outsourced security team, under the supervision of our Chief Executive Officer. Our Chief Financial Officer has over 5 years of prior work experience in various roles involving supervising the implementation of various information technology systems. These individuals are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including their roles in our overall enterprise risk management. As discussed above, our Chief Executive Officer and Chief Financial Officer regularly report to the Board about cybersecurity threat risks, among other cybersecurity related matters.

companyName: NEPHROS INC

ticker: NEPH


text: Our Board has ultimate cybersecurity and data privacy risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Compliance Committee ("Audit Committee") and the Environmental, Partner, and Community Impact Committee (the "Impact Committee"). The Audit Committee oversees our cybersecurity and technology risks, and the Impact Committee oversees our data privacy risks, all of which are integrated into our overall ERM program. The Audit Committee actively reviews and discusses our cybersecurity and technology risk management programs and regularly reports out to the full Board on our relevant strengths and opportunities. The Impact Committee reviews our data privacy risk management programs and reports out to the full Board on our relevant strengths and opportunities.

companyName: STARBUCKS CORP

ticker: SBUX


text: We recognize the importance of maintaining the security of our information systems and assets, and have several cybersecurity processes and controls designed to identify, assess and manage the risks associated with cybersecurity threats and cybersecurity incidents.

companyName: GLAUKOS Corp

ticker: GKOS


text: Board Governance Our Board of Directors reviews the cybersecurity program through risk review and cybersecurity reporting on at least a quarterly basis. The Audit Committee oversees our ERM program, including cybersecurity protocols. The Safety, Environmental, Technology and Operations (SETO) Committee provides oversight and review of technology policy and strategy as it relates to cybersecurity issues impacting company operations. Both the Audit Committee and the SETO Committee include Directors with diverse experience in technology, finance, enterprise risk, and security providing effective assessment and oversight of cybersecurity risk. Of note, one member of the Board has bolstered their understanding of technology and security issues by obtaining a certificate in cybersecurity oversight.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Our Vice President of Information Technology leads operational oversight of company-wide cybersecurity strategy, policy, standards, and processes, and works across the relevant departments to assess and help prepare us to address cybersecurity risks. Additionally, our Vice President of Information Technology participates in management's semi-annual updates to the Audit Committee. In the event of a cybersecurity incident, our Vice President of Information Technology works with our information technology department and appropriate representatives of other affected departments to assess and respond to the incident, and to determine whether internal and external reporting of the incident is merited under the circumstances. Our Vice President of Information Technology has more than 15 years of experience managing cybersecurity, including service as the Chief Information Security Officer for a multi-national company in the specialty materials industry. He has experience with compliance programs for cybersecurity-related regulations and standards such as the European Union's General Data Protection Regulation, The Payment Card Industry Data Security Standard (PCI-DSS), and the U.S. Food and Drug Administration's regulations on electronic records and electronic signatures. He has also participated in Gartner cybersecurity programs and conferences and received training in the identification and prevention of cyber threats such as spam, phishing, spear-phishing, malware, and social engineering.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Cybersecurity Risk In 2018, the United States Securities and Exchange Commission (the "SEC") published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal laws and regulations. If we fail to observe this regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations or financial condition, but there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in significant costs related to, for example: rebuilding our internal systems, implementing additional threat protection measures, providing modifications to our websites and mobile applications, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing merchants and customers with incentives to maintain a business relationship with us, taking other remedial steps with respect to third parties or incurring significant reputational harm. In addition, these threats are constantly evolving, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in the volume, frequency and sophistication of cyberattacks. We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications; however, we remain potentially vulnerable to known or unknown threats. It is also possible that we, our merchants, our customers or our vendors will be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See Item 1A. - Risk Factors for more information on our cybersecurity risks.

companyName: Groupon, Inc.

ticker: GRPN


text: Hubbell's Board of Directors (the "Board") recognizes the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated oversight of risks associated with cybersecurity threats and has developed mechanisms to ensure effective oversight in managing such cybersecurity risks. The Audit Committee is composed of Board members with diverse expertise, including cybersecurity and technology, financial, and risk management experience.

companyName: HUBBELL INC

ticker: HUBB


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy with our President & COO and approves our technology strategic plan.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our cybersecurity strategy leverages people, processes, and technology to identify and manage cybersecurity risks, including through: security monitoring; vulnerability assessments; patching and security upgrades; deployment of network defenses; regular cybersecurity trainings for users; use of third-party cybersecurity vendors to complement our internal Cybersecurity and IT Infrastructure team, including for monitoring, remediation, and response capabilities; periodic engagement of cybersecurity consultants, including for cybersecurity maturity assessments and recommendations and penetration test exercises; and periodic reviews of aspects of our cybersecurity program by our Internal Audit function.

companyName: Coeur Mining, Inc.

ticker: CDE


text: Risk Management & Strategy Cybersecurity is integrated into the Company's overall risk management program. The Company has established a cyber risk management program that identifies and manages risks to our information assets that could be affected by a cyberattack. The Company leverages both internal and external threat detection and response capabilities, combined with a people-centric approach to employee awareness and engagement. The Company considers risks related to people, processes, and technology including those associated with our third-party service providers and allocates resources to maintain and enhance our cybersecurity measures.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: Our Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and intended to comply with applicable laws governing the use and protection of data, including HIPAA. In general, the Company seeks to address cybersecurity risks by focusing on preserving the confidentiality, integrity, and availability of the information that the Company collects and by aiming to identify, prevent and mitigate cybersecurity threats and respond to cybersecurity incidents when they occur.

companyName: AGILITI, INC. \DE


text: Our Board oversees risk management for the Company including through its approval of the investment policy and other policies of the Company and its oversight of the Advisor. For certain risks, the Board has delegated oversight responsibilities to committees of the Board. For example, the Compensation Committee oversees and reports to the Board on the assessment and mitigation of risks associated with the Company's and the Advisor's compensation policies and practices, and the Nominating and Corporate Governance Committee assists our Board with assessing risks associated with conflicts of interest and with ESG matters. Cybersecurity risk management is integrated into this broader risk management framework. The Board has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: We support a risk-based cybersecurity program with control alignment to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The core functions of the program are designed to manage cyber-related risks and strengthen the overall cybersecurity posture of our organization.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: The Company's Board of Directors provide ultimate oversight of the Company's cybersecurity risk management program. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CISO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats.

companyName: Vestis Corp

ticker: VSTS


text: Our Head of IT works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, cross-functional teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of IT monitors the prevention, detection, escalation, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our audit committee when appropriate.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: Although risks from cyber threats have not materially affected the Fund's business strategy, results of operations or financial condition as of December 31, 2023, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see "Due to the Increased Use of Technologies, Intentional and Unintentional Cyber Attacks Pose Operational and Information Security Risks" in Item 1A. Risk Factors.

companyName: Invesco DB Multi-Sector Commodity Trust


text: Our cybersecurity risk management program is overseen by our Executive Cybersecurity Risk Group (ECRG) which is comprised of our Chief Digital and Information Officer (CDIO), Chief Financial Officer and Chief Legal Officer. The ECRG, working with our Chief Information Security Officer (CISO), assists the Board of Directors and our senior leadership team in fulfilling their responsibilities for cybersecurity governance, approval and oversight through the periodic reporting and review of security strategy and risk management practices. Our cybersecurity risk management program is integrated into our overall risk management processes and shares common reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk governance programs.

companyName: AMERICAN AIRLINES, INC.


text: We provide routine awareness training for associates regarding cybersecurity best practices and their role in protecting the Company from cybersecurity attacks and testing to measure the effectiveness of our information security program.

companyName: Citi Trends Inc

ticker: CTRN


text: Our board of directors has established oversight mechanisms to manage risks from cybersecurity threats. The audit committee of our board of directors (the Audit Committee"), has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once a year and following any material cybersecurity incidents. Our board of directors receives periodic updates from our Audit Committee regarding matters of cybersecurity. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives.

companyName: iTeos Therapeutics, Inc.


text: Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks The principal objectives of our Cyber Risk Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property and other assets of E2open, and those of our clients, vendors, partners, employees and consumers that can be at risk due to cybersecurity threats to E2open.

companyName: E2open Parent Holdings, Inc.


text: Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of preventative measures and detective tools.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Our ERM program is maintained and overseen by a cross-functional team of business leaders from across the organization. The program incorporates regular sessions to review the Company's overall risk posture, identify new risks and develop mitigation strategies. ERM matters are reviewed with the Risk Council Review Committee and are ultimately overseen by the Audit Committee of the Board of Directors, which regularly meets with and receives guidance and support from the Board of Directors.

companyName: Arcadium Lithium plc


text: The CISO works collaboratively with business and functional colleagues to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. Multidisciplinary teams are deployed to respond to cybersecurity incidents in accordance with our incident response plans. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to senior management, who escalate to the Board as appropriate.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: We maintain a Corporate Incident Response Plan ("CIRP") that provides a documented set of protocols for responding to actual or potential cybersecurity incidents, including timely detection and analysis, containment and elimination, and recovery and improvement following an incident. The CIRP provides for notification of appropriate information breach or cybersecurity incidents and escalation to the Company's appointed Incident Management Team, which would be composed of an Incident Response Lead and team members from information technology, information security, enterprise risk management, corporate security, compliance, and legal teams, among others. The Incident Management Team would leverage the expertise of team members to work together to respond to the incident and take appropriate measures. The Senior Risk Committee would oversee the team and receive quartelry reporting on the incident and any relevant updates. The CIRP is coordinated through Incident Management Teams that involve the Bank's Incident Management Lead, Chief Digital & Innovation Officer, Chief Information Security Officer, and other key departments.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: Cybersecurity risk management is a core component of our enterprise risk-management framework. Cybersecurity incidents and threats pose a risk to the disruption of our business operations, including the confidentiality, integrity and availability of data and information. CFC's cybersecurity program is designed to manage operational risks associated with the ever-evolving nature of cybersecurity threats. Because these risks could have a material adverse impact on our operations and reputation, both management and the CFC Board of Directors are actively engaged in the oversight of the cybersecurity program and our continuous efforts in monitoring, measuring and managing the risks.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including but not limited to cybersecurity assessors, consultants, and auditors to evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaborations with these third-parties includes regular audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CIO and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Risk assessment and management - Our corporate and product security professionals assist in managing cybersecurity systems and in preventing, detecting, assessing, and resolving cybersecurity incidents. We build cybersecurity principles into our product development and system design, we have internal and external penetration testers who test our product platform and corporate systems, and we have a bug bounty program that can incentivize external security researchers who help us identify and fix bugs and vulnerabilities before they are exploited. Our internal audit team and our company's independent auditors periodically assess the effectiveness of certain of our cybersecurity-related controls. From time to time, we also engage external consultants and advisors to perform independent security testing and assessments and to assist with aspects of our cybersecurity program. We also utilize automated technology that alerts our security team of unusual activity in our corporate systems, product platform, and public-facing systems as well as automated security vulnerability scanning for our code base. As part of our processes, we require applicable internal approvals for changes to security-critical aspects of our product platform and services.

companyName: Dynatrace, Inc.

ticker: DT


text: Our CISO has more than 25 years of experience in cybersecurity and information technology, including, prior to joining KDP in 2019, more than 11 years as a principal in Ernst & Young's cybersecurity practice. Our CISO reports directly to our Chief Information Officer, who also has over 36 years of experience in information technology and cybersecurity.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: Our Chief Administrative Officer, along with a third-party service provider, are responsible for operational oversight of our cybersecurity strategy and policies. Any identified cybersecurity incident is reported to our Chief Administrative Officer who evaluates the severity of the incident. Based on this assessment, further steps are taken involving other members of management and, depending on the severity, the audit committee and the Board of Directors. We believe this structured approach allows us to effectively manage and mitigate cybersecurity risks, safeguarding our systems and data against various digital threats. Additionally, our proactive stance is supported by cybersecurity insurance, which further reinforces our preparedness against potential cyber threats.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: Our management team, including our Chief Digital and Information Officer and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: We believe each of Synovus' employees has a role in the Company's cybersecurity defenses. Employees at various levels and in various lines of business and support functions participate in training programs on cybersecurity and social engineering to mitigate risk, including required annual training, quarterly training on critical topics, and bi-monthly security awareness communications. We conduct exercises to test their effectiveness on a monthly basis.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: All committee activities are reported to the Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director. The Risk and Technology Committee provides similar reports to the full Board quarterly, as well as on an as-needed basis. Results of cybersecurity-related audits are also reported to the Board's Audit and Finance Committee.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Equinix cybersecurity risk management activities and outcomes are guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and assessed by a third party. In addition, our cybersecurity program is certified globally against the International Organization for Standardization ("ISO") 27001 standards. Currently, our cybersecurity program includes the following key categories of security controls with many security capabilities serving under each category: Governance, Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Contingency Planning, Incident Response, Data Security, Continuous Monitoring, Maintenance Controls, Media Protection, Physical Protections, Risk Assessment, Third-Party Risk Management, System and Communications Projection, and System and Information Integrity.

companyName: EQUINIX INC

ticker: EQIX


text: The Company's cybersecurity risk management strategy is comprised of several key elements. We assess our information technology and data management/storage systems and related policies and practices to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. We leverage a variety of technologies to attempt to mitigate the risk of cybersecurity threats and incidents. The Company has a multi-layer approach to its technology solutions, including employing applications used for perimeter, network, end point and application security as well as for data recovery, in each case tailored to the Company's systems, data, risk profile and mitigation strategy. From time to time, we use third-party service providers and software to augment and test our technology solutions and further support our risk mitigation strategy. Further, the Company maintains processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers.

companyName: CTS CORP

ticker: CTS


text: Pathward has robust cybersecurity measures in place. Pathward is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pathward, including its business strategy, results of operations or financial condition, during the fiscal year ended September 30, 2024. Yet, in this modern, evolving world cybersecurity remains a high risk regardless. For further information about the cybersecurity risks Pathward faces, and potential impacts, see Item 1A. "Risk Factors".

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: approach to asset protection that is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals. This same organization provides proactive notification and consultation on emerging threats and potential mitigation.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: The Cybersecurity and Information Technology Incident Response Plan is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk. In the event of a material or potentially material cybersecurity event, senior members of management, which includes the Chief Financial Officer, are promptly informed of the event and status update, response, and disclosure efforts following the terms of a documented incident response plan. Key elements of the Cybersecurity and Information Technology Incident Response Plan include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology ("IT") environment; • an incident response team principally responsible for managing cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity and IT incident response plan that includes procedures for responding to cybersecurity incidents; • utilization of independent third parties to perform penetration testing of the Company's environment; and • utilization of a third party to monitor our environment continuously.

companyName: Carter Bankshares, Inc.

ticker: CARE