text: We are a SPAC with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: iLearningEngines, Inc.


text: Securities and Exchange Commission's new cybersecurity disclosure requirements under Regulation S-K Item 106 are not applicable to this Annual Report on Form 10-K for the fiscal year ended December 31, 2022. These new disclosure requirements become effective for annual reports filed for fiscal years ending on or after December 15, 2023. As such, we are not required to provide the cybersecurity risk management, strategy, and governance disclosures mandated by Item 106 in this report. We will include the required cybersecurity disclosures in our Annual Report on Form 10-K for the fiscal year ending December 31, 2023, which we intend to file in 2024. At that time, we will provide information on our processes for assessing, identifying, and managing material risks from cybersecurity threats, as well as details on our board's oversight and management's role in cybersecurity risk management.

companyName: SRAX, Inc.

ticker: SRAX

secItem: Item 1C


text: Our information security program is managed by a dedicated CISO, whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CISO has more than 20 years of experience directing disparate teams across application and product security, cyber defense, risk management, information governance, information technology compliance, information technology training and sales. Our CISO is appointed by the RACC, which also oversees the implementation, monitoring and testing of our information security program. Our CISO and CRO provide periodic reports to the RACC, at least quarterly. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security posture, assessments of the information security program, and the emerging threat landscape. Our CISO and CRO also regularly meet separately with the chair of the RACC to provide similar updates. Our information security program includes incident response procedures designed to facilitate escalation of actual or potential cybersecurity incidents initially to members of our security team, and as appropriate to senior management and the RACC, to allow proper consideration, mitigation and remediation of, as well as evaluation of potential disclosure obligations with respect to, actual or potential cybersecurity incidents. Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the RACC. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program.

companyName: Q2 Holdings, Inc.

ticker: QTWO


text: Roivant and the Vants' information security organization manages a robust enterprise security structure with the goal of preventing and mitigating any cybersecurity incidents, while simultaneously working to continually increase information technology system resilience designed to minimize any business impact should a cybersecurity incident occur. Central to Roivant's information security organization is our Cybersecurity Incident Response Team, which is responsible for the protection, detection and response capabilities used to protect our data and enterprise computing networks. A Cybersecurity Risk Governance Committee oversees processes for identifying and mitigating cybersecurity threats and incidents and helps align our risk exposure with our strategic objectives. Cybersecurity threats and incidents deemed to have a moderate or higher business impact, even if immaterial to us as a whole, are reported to the Corporate Risk Management Committee and shared with Roivant's board of directors.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: We have implemented and maintain a robust cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Leslie's, Inc.

ticker: LESL


text: The Company plans to use reasonable, cost effective, and secure methods for notifications in the event of a data breach. While we have experienced and may continue to experience certain cybersecurity incidents, we do not believe any such incidents incurred to date have materially affected our Company, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A — "Risk Factors — Operational Risks — 'If we are unable to safeguard against security breaches with respect to our information technology systems, our business and our reputation may be adversely affected'," which should be read in conjunction with the information above.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: Board of Directors The Audit Committee of our Board (the "Audit Committee") oversees, among other things, the controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, our Chief Financial Officer and our Head of Information Technology report on cybersecurity matters, including material risks and threats, to the Audit Committee, and the Audit Committee provides updates to our Board, in each case as frequently as is appropriate.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: On December 5, 2024, we announced that our CTO would cease serving as CTO effective December 31, 2024, and that we had initiated a search for her successor. In the interim, two current vice presidents of engineering, one of whom is our CISO, are providing interim leadership of our engineering organization. Our CISO is also primarily responsible for cybersecurity and risk-related matters in his capacity as interim Co-CTO, with assistance from our Senior Director of Information Security. Our CISO has nearly twenty years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture and design, as well as several relevant degrees and certifications, including a Bachelors of Science in Computer Engineering from the University of Denver, and IAPP Certified Information Privacy Technologist. Our CISO previously held certifications include ISC2 Certified Information Systems Security Professional, EC-Council Certified Chief Information Security Officer, and ISACA Certified Data Privacy Solutions Engineer.

companyName: ETSY INC

ticker: ETSY


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: We experienced a cyberattack in January 2023. We believe the incident has not had nor will have a material impact on our business, operations, ability to serve our customers, or financial results. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts. See " Risk Factors - Cyberattacks, like our 2023 cybersecurity incident, can lead to disruption of business, reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position."

companyName: QUICKLOGIC Corp

ticker: QUIK


text: The following information provides an overview of our approach to managing cybersecurity risks. The Company assesses, identifies and manages cybersecurity related risks. Cybersecurity related risks are evaluated to assess top risks to the enterprise on a bi-annual basis. SoundHound has implemented a comprehensive cybersecurity program designed to identify, assess, and manage cyber risks.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Risk Management and Strategy Martin Marietta prioritizes the management of cybersecurity risk and the protection of information across the enterprise by embedding data protection and cybersecurity risk management in its operations. The Company's processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into the Company's overall risk management system and processes.

companyName: MARTIN MARIETTA MATERIALS INC

ticker: MLM


text: The material cybersecurity threats identified through these processes are managed by our CISO and, where appropriate, our risk and compliance committee, in consultation with management. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.

companyName: Myseum, Inc.

ticker: MYSE


text: Our senior leadership is responsible for identifying, assessing and managing our exposure to risk, including cybersecurity risks. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our Chief Information Officer reports directly to our Chief Executive Officer. Pursuant to our formal incident response plan, suspected cybersecurity incidents are first evaluated by our "Initial Incident Response Team" led by our Chief Information Officer and comprised of representatives from our information technology, human resources, safety, legal, finance and communications departments, who jointly determine if the incident may result in a business interruption, require reporting to regulators, employees and/or business partners, have a material financial impact or cause reputational harm and should be escalated to our executive incident response team, which includes our Chief Executive Officer, Chief Financial Officer and General Counsel. For all matters that have been escalated, the responsible team executes specified procedures to contain the incident, implement incident response procedures and implement and document remediation measures.

companyName: MATERION Corp

ticker: MTRN


text: Our cybersecurity risk management process is integrated with our overarching risk management system, led by our ERM team, and further guided by our Technology Risk Committee. Our Technology Risk Committee is responsible for approving the effectiveness of our cybersecurity risk framework and assisting with the oversight of decisions that affect compliance with applicable legal and regulatory matters and corporate policies. As part of the management oversight structure, the ERM team provides our Management Risk Committee with periodic updates on key risk conditions, strategy and mitigation efforts.

companyName: HERBALIFE LTD.

ticker: HLF


text: We have established processes for identifying, assessing and managing material risks from cybersecurity threats associated with our key information technology systems. These processes have been integrated into our overall risk management strategies, as overseen by our Board of Directors, primarily through the Corporate Risk Committee and Audit Committee. These processes also include identifying and overseeing risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we conduct employee training on information security topics designed to address phishing and e-mail security, password security and data-handling security. We use e-mail security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing e-mails and avoid IT system interruptions. From time to time, we engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate cybersecurity threats and incidents as appropriate. Additionally, our Enterprise Risk Management ("ERM") team analyzes cybersecurity risks, emerging industry trends and identification of mitigation, as part of a holistic analysis of risks across CHS.

companyName: CHS INC

ticker: CHSCP


text: While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks, and have requirements for our suppliers to do the same. Data safeguard practices of suppliers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by our suppliers. When we do become aware that a supplier's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of the Company's information systems.

companyName: FORD MOTOR CREDIT CO LLC


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network. See "Risk Factors – Our success depends on the security and integrity of the games we offer, and security breaches or other disruptions could compromise our information or the information of our players and expose us to liability, which would cause our business and reputation to suffer."

companyName: Playtika Holding Corp.

ticker: PLTK


text: The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to:

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Monthly internal and external penetration testing is conducted and reviewed either by independent third parties or qualified employees not involved in developing or maintaining the security program. An audit is performed annually by qualified internal auditors or contracted independent parties and is overseen by the Company's Audit & Compliance Committee of the Board of Directors ("Audit Committee"). Management promptly reviews test results to initiate necessary remediation, which are then reviewed by the Audit Committee, third-party auditors, and examiners. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: The Company has cloud-based security, and their computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers.

companyName: Pacific Sports Exchange Inc.

ticker: PSPX


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: EASTERN CO

ticker: EML


text: FactSet recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, violation of data privacy or cybersecurity laws, legal and regulatory risks, and reputational risks.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Impact of Risks from Cybersecurity Threats — As of the date of this Annual Report, we are not aware of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, although the Company regularly experiences cybersecurity incidents that are not deemed material to our operations. Examples of cybersecurity threats we face include incidents common to most companies in the energy industry, such as phishing, business email compromise, ransomware and denial-of-service, as well as attacks from more advanced sources, including nation state actors, that target companies in the energy industry. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely disrupt our operations, including our drilling operations, and affect our performance and results of operations. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Please see Part I, Item 1A. "Risk Factors — Risks Related to our Business and the Oil and Natural Gas Industry — Our business could be negatively affected by security threats, including cybersecurity threats, terrorist attacks and other disruptions."

companyName: TALOS ENERGY INC.

ticker: TALO


text: a cybersecurity incident response plan and business continuity cybersecurity training for employees and key business partners with access to our systems. a third-party cybersecurity risk management process for service providers and vendors who access our systems.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: We recognize that our third-party vendors can be subject to cybersecurity incidents which may impact us. To mitigate third-party risk, vendor access to our network resources is reviewed, authorized, and monitored for appropriateness. Third-party IT vendors that are determined to present a higher risk are also subject to additional diligence such as questionnaires, inquiries, and relevant certifications.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: We also apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers, including those in our supply chain that have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk process. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

companyName: Compass Group Diversified Holdings LLC


text: The protection of our clients' data, our brand, and our systems is of utmost importance. We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security. We have implemented comprehensive cybersecurity and data privacy programs, fostering a culture of awareness across all employee groups and systems. In 2025, we achieved SOC2 Type 2 certification, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA). This achievement builds on our previous SOC2 Type 1 certification and complements our ongoing TX Ramp compliance.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: We have a cybersecurity program to identify, monitor, and mitigate cybersecurity risks. The security program consists of responsibilities for information security and incident response and is overseen by a third-party consultant with guidance from subcontracted cybersecurity vendors that our third-party consultant contracts. We consider cybersecurity risks alongside other company risks and consult with subject matter experts where necessary to identify cybersecurity risks and evaluate their nature and severity.

companyName: CEA Industries Inc.

ticker: BNC


text: The Company's IT department, in coordination with the Company's legal department, General Counsel ("GC"), Chief Financial Officer ("CFO"), Senior Vice President of Finance ("SVP Finance") and as needed each operating company's IT department (collectively, the "Data Breach Response Team"), works collaboratively to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Policy. The Company's response planning is reviewed annually and kept up to date with industry developments.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: The audit committee receives regular reports from the Security Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: The Information Systems Representative, in coordination with senior management including our Chief Executive Officer and Chief Financial Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 25 years, including serving as the Director of Information Technology of another public company.

companyName: Viking Therapeutics, Inc.

ticker: VKTX


text: The Registrants and their third-party vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems, or confidential data, or to disrupt operations. None of these attempts has individually or in aggregate resulted in a security incident with a material impact on the Registrants financial condition or results of operations. Although prior incidents have not materially affected the Registrants, any future incidents related to the Registrants' information systems due to theft, ransomware, viruses, increased use of artificial intelligence technologies, denial of service, hacking, acts of war or terrorism, or inappropriate release of certain types of information, including confidential customer information or system operating information, could have a materially adverse impact on the Registrants, and affect their business strategy, results of operations or its financial condition. See "Item 1A. Risk Factors" for further discussion.

companyName: OGE ENERGY CORP.

ticker: OGE


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and CISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The CISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and CISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The CISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets eight times a year. The IT and Audit Committees assist the Board of Directors in its oversight.

companyName: RBB Bancorp

ticker: RBB


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, the Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.

companyName: Level 3 Parent, LLC


text: Management also generally provides quarterly updates to the audit committee on cybersecurity and other information technology risks. We have implemented a process for the Director of IT and the VP of Finance to receive incident reports and report quarterly (and, if applicable, in the event of a cybersecurity incident), to our internal disclosure committee and the audit committee, as appropriate. Management presents to the entire board of directors on an annual basis, including any key findings identified in our cybersecurity assessments.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Cybersecurity and Data Privacy Risks We are subject to cybersecurity and data privacy risks. Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.

companyName: Bannix Acquisition Corp.


text: The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may become insufficient. In addition, new technology that could result in greater operational efficiency such as our use of AI, fleet electrification, and autonomous vehicles may further expose our operations and computer systems to the risk of cybersecurity incidents. Newmont did not identify any cybersecurity incidents during the year ended December 31, 2024 that have materially affected or are reasonably likely to materially affect Newmont's business strategy, results of operations, or financial condition.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm, and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy is that all WTW colleagues are required to receive annual, mandatory privacy and information security training. • Third-Party Risk Management: WTW's risk management strategy includes a third-party risk management process that is intended to be aligned to the technology security key controls across the organization. • Threat Intelligence: WTW seeks to obtain threat intelligence on cyber threats to WTW at the strategic, operational and tactical levels.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: The Company engages in the periodic assessment and testing of the Company's policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties, including auditors and consultants, to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Company's risk management function, and the Company adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Cybersecurity is an important part of our risk management processes. Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board of Directors oversees the management of systemic risks, including cybersecurity threats, in accordance with its charter.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Audit Committee: Our Audit Committee provides additional oversight of material risks from cybersecurity threats and engages with our CTPO or CISO regarding risk management of cybersecurity issues and to discuss potential updates to the Company's cybersecurity risk management program, including as a result of any Cybersecurity Task Force findings. The Audit Committee receives a quarterly report from the Company's cybersecurity team, which includes the CTPO, CISO, and members of the information security team, that summarizes progress on cyber-related key performance indicators, including product security, cloud security, risk and compliance, identity issues, and cyber defense. The Audit Committee updates the full Board on matters relating to material cybersecurity risks at least quarterly.

companyName: TheRealReal, Inc.

ticker: REAL


text: Cybersecurity Risk Strategy and Management Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Tier 3. No direct system access but may be associated through a partnership or have links hosted or embedded within Company marketing material or websites.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Chief Administrative Officer is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection and mitigation and remediation of cybersecurity incidents and supervising such efforts.

companyName: Streamex Corp.

ticker: STEX


text: The Company's CCO has over twenty-seven years of experience in the financial services industry, including eighteen years specializing in compliance and nine years in technology. The Company's CCO is actively involved in monitoring and addressing cybersecurity risks in consultation with the Advisor's CTO and COO. The Company's CCO is informed of incidents, vulnerabilities, and control enhancements in order to ensure robust and effective cybersecurity practices.

companyName: 5C Lending Partners Corp.


text: Managing incident response Providing regular reports to senior management and the Audit Committee In the event of a material cybersecurity incident, our SVP of IT is responsible for promptly reporting to the CEO and the Audit Committee. A special meeting of the Audit Committee or full Board may be convened as necessary to address significant cybersecurity matters.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our commitment to cybersecurity resilience includes an ongoing monitoring program and a well-defined incident response plan that provides clear guidelines for mitigating the impact of any future cyber threats and incidents. These processes are periodically reviewed and updated to address emerging threat intelligence.

companyName: Urgent.ly Inc.

ticker: ULY


text: We have developed an information security program that is designed to address material risks from cybersecurity threats and our cybersecurity risk management processes are integrated into our overall risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A cybersecurity risk assessment, based on an internationally recognized methodology, is conducted annually.

companyName: GUESS INC

ticker: GES


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents. We have not identified any material cybersecurity incidents to date.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Management's Assessment and Response to Material Risks from Cybersecurity Threats Our information security team and its leadership have primary responsibility for assessing and managing cybersecurity risks, within the scope of the overall ERM Committee.

companyName: LITHIA MOTORS INC

ticker: LAD


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures and evaluating guidelines and policies with respect to our risk assessment and risk management. Our Chief Legal Officer working with the CIO and other senior management is responsible for determining and coordinating reports and updates to the Audit Committee or the Board of Directors, or as requested by the Audit Committee or the Board of Directors. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. The Board of Directors receives an update on the Company's risk management processes and the risk trends related to cybersecurity at least annually.

companyName: HELEN OF TROY LTD

ticker: HELE


text: The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.

companyName: OGE ENERGY CORP.

ticker: OGE


text: for managing cybersecurity risks tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, CyberTeam oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps are taken.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: We have an enterprise-wide information security program designed to assess, identify, and manage the Company's information security risks and identify, evaluate, respond to and resolve information security incidents. To protect our information systems from information security incidents, we use various processes and tools to identify, prevent, detect, escalate, investigate, resolve and recover from identified vulnerabilities and threats. These include, but are not limited to, reporting, monitoring and detection tools that are widely used in the industry, and internal solutions. We have an enterprise-wide Information Security Incident Response Plan ("IRP"), which describes the detailed processes and procedures that should be followed in the event of an information security incident. We conduct assessments based on the National Institute of Standards and Technology cybersecurity framework (the "NIST CSF") to measure our progress under the maturity framework of NIST CSF and continue to identify opportunities for improvement in our information security program.

companyName: Chewy, Inc.

ticker: CHWY


text: Protect assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program incidents regardless of source or causality through planning, improvements and communications (external and internal)

companyName: VanEck Bitcoin ETF

ticker: HODL


text: Our Chief Information Security Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy " above. The processes by which our Chief Information Security Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: tabletop exercises, vulnerability management programs, internal & external security risk assessments, threat modeling processes of new services, third party security risk functions, incident response processes, phishing awareness programs, and additional control validation services.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Processes and controls we have implemented with the assistance of our third-party IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third party cybersecurity firm; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; • leverage the CIS Controls incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a Business Combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Compass Digital Acquisition Corp.

ticker: CDAQF


text: Our third-party information technology vendors are assessed by independent auditors for compliance with System and Organization Controls ("SOC") 1 and SOC 2. Access to our networks for third-party vendors is limited exclusively to the application related to the services for which they are engaged to provide. We routinely conduct external risk analyses by employing third-party rating tools to assess our vendors, quantifying and prioritizing identified risks based on the number and severity of vulnerabilities. Subsequently, we communicate these risks to our vendors proactively, seeking their collaboration in remediation efforts.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: We have implemented a comprehensive cybersecurity and data privacy program as part of our risk management processes to assess, identify and manage risks posed to our business by cybersecurity threats. We embed cybersecurity considerations into every material aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to cybersecurity threats. Our cybersecurity risk management processes are grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 18, OWASP Top 10, and Security by Design and are intended to prevent adverse effects on the confidentiality, integrity and availability of our information systems and information residing therein.

companyName: Certara, Inc.

ticker: CERT


text: • Training: We have a cybersecurity training program in place for employees. Additionally, our engineers regularly undergo secure code training. • Third-Party Risk Management: Our security experts and our legal team work together to assess third-party vendors to confirm that each vendor contract requires adequate technical and organizational measures to protect the systems and data that such vendor operates or processes on behalf of Zuora. Additionally, we maintain a Supplier Code of Conduct that sets forth our vendor expectations and a Vendor Data Access Policy that establishes the limits on what information our vendors may see, access, modify, and control. • Assessments and Testing: We engage in the periodic assessment and testing of our cybersecurity policies, processes, and practices. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We also engage third parties (including auditors and cybersecurity consulting firms) to perform assessments of our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We adjust our cybersecurity policies, processes, and practices based on the information provided by these assessments and testing activities. • Cybersecurity and Privacy Certifications: Zuora has maintained various security certifications, including ISO 27001, ISO 27002, ISO 27018, ISO 27701, PCI, and SOC 2 Type II.

companyName: ZUORA INC


text: Spire maintains business continuity plans to guide the Company's response to a potential cybersecurity event. These plans are regularly reviewed, tested and updated to ensure they meet the evolving needs of the Company in this area. The Company also conducts annual disaster recovery exercises to test the efficacy of core systems in the event of a catastrophic incident.

companyName: SPIRE INC

ticker: SR


text: Angelina C. Day has served as the Company's Vice President and CIO since July 2022. In this role, she is responsible for all aspects of information technology, including cybersecurity. Prior to joining the Company, Ms. Day was IT Director at EP Energy Corporation, an independent E&P company, from May 2012 until March 2022, where she oversaw the information technology and security functions. Prior to EP Energy, Ms. Day held various roles with increasing responsibility in technology and leadership at El Paso Corporation. Ms. Day has over 20 years of energy, technology and risk management experience. She is also a member of the Houston CIO Community (Evanta) Governing Body, an organization that fosters collaboration and knowledge sharing across the Houston CIO community. Ms. Day holds a B.B.A. in Computer Information Systems from the University of Houston Downtown.

companyName: Callon Petroleum Co


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information, and other confidential data that we collect and use in connection with our business, and the importance of assessing, identifying, and managing various cybersecurity risks that may impact our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other relate breaches.

companyName: Mersana Therapeutics, Inc.


text: A robust and consistent approach to cybersecurity is critical to achieving our strategic business objectives and protecting our intellectual property. As an advanced technology company developing quantum photonic products, we face a wide range of cybersecurity threats such as ransomware and denial-of-service attacks that affect most industry sectors, to attacks from highly sophisticated adversaries, including nation state actors, that target dual-use advanced technologies such as quantum computing. Our customers, suppliers and other business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. We are continually evaluating best practices and methods to protect the Company from a wide range of potential threats. Due to the risks that these cybersecurity threats pose to our business, we are investing in cyber defense systems and training programs.

companyName: Quantum Computing Inc.

ticker: QUBT


text: Third Party Risk Management We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. The Verizon Third Party Risk Management Program establishes governance, processes and tools for managing various supplier-related risks, including information security. As a condition of working with Verizon, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software. Additionally, we generally require those high risk third parties to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: GLAUKOS Corp

ticker: GKOS


text: We acknowledge that risk is a natural part of the financial industry. The threat landscape is ever-changing, and with increasingly sophisticated techniques, threat actors pose a greater risk to Mid Penn and its customers, leaving us vulnerable to cyberattacks and information security incidents. However, our commitment is to maintain a careful balance between innovation and risk mitigation. To achieve this, we have developed a risk appetite that aligns with our strategic goals and regulatory requirements. This framework encourages innovation while ensuring our risks are well-understood, measured, and managed. MID PENN BANCORP, INC.

companyName: MID PENN BANCORP INC

ticker: MPB


text: As discussed earlier under General Risk Factors, we have become increasingly dependent upon technology, including information systems as well as infrastructure and cloud applications and services. These technologies are used to operate our businesses, process and record financial and operating data, communicate with our business partners, analyze mining information, estimate quantities of coal reserves, and perform other activities related to our business.

companyName: Ramaco Resources, Inc.

ticker: METC


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Vice President of Finance, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Cyclo Therapeutics, Inc.


text: The Audit Committee receives regular reports from management, including our Chief Technology Officer ("CTO") and Director of Information Security. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: FIGS, Inc.

ticker: FIGS


text: We are subject to various cybersecurity risks in connection with our business. See the section entitled "Cybersecurity Risks" in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K. Our cybersecurity program is led by an experienced team of cybersecurity professionals headed by our Vice President of Cybersecurity, reporting to our General Counsel.

companyName: ANSYS INC


text: We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.

companyName: CULP INC

ticker: CULP


text: Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Board of Directors reviews and approves an Information Technology and Information Security Risk Appetite Statement which guides the actions of the management team, staff members and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Mutual Savings and Loan Association's compliance with the Gramm-Leach-Bliley Act, risk management program, vendor management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: The Risk Committee of the BOD and ERM Committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cybersecurity and information security. The Audit Committee of the BOD oversees the audit control functions of which cybersecurity practices may be a part. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have specific infrastructure, systems, policies, and procedures designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identifying and managing cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Please see the section entitled "Risk Factors –Failure to maintain the security of our information and technology networks, or those of our third-party service providers, or cyber security incidents could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow," for more information.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: We maintain a cybersecurity program and framework as set forth in our cybersecurity policies and standards. The foundation of our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which includes a set of controls to prevent, detect, and respond to cybersecurity threats and incidents. These controls include constant monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying and managing material cybersecurity risks, we: • Leverage technology solutions, including proactive detection tools, to protect our assets and detect threats in our environment; • Perform regular internal assessments of our cybersecurity program against the NIST Cybersecurity Framework. The results of these assessments are then reviewed and, based on such findings, action plans are developed and progress tracked through completion; • Analyze both internal and external cybersecurity incidents and related threat intelligence to determine applicability to our environment and industry. Findings from such analyses are then reviewed and utilized to create action plans where applicable and relevant to our environment and industry; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery standards and compliance procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing to ensure that the Company's mission-critical systems are recoverable, in support of the business continuity needs of our various business lines; • Maintain an operational technology (OT) security program to address cyber risks that are inherent and unique to our industry and manufacturing environment; • Maintain a centralized product security program that unifies company-wide strategy to ensure our customer-facing products and services are secure by design; and • Integrate each of our business and corporate groups with our internal cybersecurity team to ensure cybersecurity requirements are embedded into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, senior and executive management, as well as our Board of Directors, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Trane Technologies plc

ticker: TT


text: We maintain a cyber insurance policy, we periodically meet with our insurer to discuss emerging trends in cybersecurity and we utilize self-assessment tools and other services provided by our insurance broker and insurer, including annual tabletop exercises conducted by cybersecurity experts.

companyName: Mid-America Apartments, L.P.


text: We design and assess our program based on the Center For Internet Security ("CIS") Controls. While this does not imply that we meet any particular technical standards, specifications or requirements, we use the CIS Controls framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: 10x Genomics, Inc.

ticker: TXG


text: Our CISO has served in that position since 2018 and is an experienced security leader with over 20 years' experience. In addition to his current role, our CISO has led security and IT audit functions at healthcare technology and population health organizations. His experience includes work in the fields of security, application development, and internal audit at a Fortune 100 company. Our CISO is a Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), and a member of the ISACA and ISSA organizations. He received his bachelors' degree from Middle Tennessee State University and served in the United States Marine Corps. Additionally, Gerald W. Shields, our CEO and a member of the Board, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, he has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.

companyName: CITIZENS, INC.

ticker: CIA


text: See Item 1A. "Risk Factors – Disruptions to, security breaches or non-compliance involving, our information technology systems could harm our ability to run our business and expose us to potential liability and loss of revenues." for a discussion of cybersecurity risks that may materially impact us.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: To the extent we identify areas in our information systems that need improvement, we seek to timely implement and monitor such improvements.

companyName: RenovoRx, Inc.

ticker: RNXT


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. With respect to our use and oversight of third-party service providers, we use a risk-based approach to apply our cybersecurity processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and perform additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including risk assessments for each vendor, vendor security questionnaires and due diligence in connection with onboarding new vendors, and ongoing reviews and due diligence with key or high-risk third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.

companyName: Immunovant, Inc.

ticker: IMVT


text: We have processes designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President Legal and Compliance, Vice President Finance and Administration, Vice President - Controller, Chief Financial Officer and Director of Information Technology. In addition, the Company's incident response policy includes a process for reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Role of Management IZEA's CEO, our Director, Systems & Security, and our Senior Development Operations (DevOps) leader jointly manage of our cybersecurity risks. We have established a Security Council, which includes our CEO, Director, Systems & Security, Senior Manager, Systems & Security, Chief Financial Officer, General Counsel, and other senior officers, that meets quarterly to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: The Cybersecurity Committee, including the Company's director of technology, receives regular updates from the Company's management on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.

companyName: Cohen & Co Inc.

ticker: COHN


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess, and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third party advisors.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: We have established cybersecurity risk assessment processes, which include annual risk assessments using third-party consultants. Our Chief Information Security Officer ("CISO") has oversight over our information security policies and works with our internal IT resources and third-party managed IT support providers to facilitate the implementation of our cybersecurity risk assessment and management processes. Our cybersecurity risk management processes are designed to protect systems and data and contain preventive and detective controls, including internal and external testing. We also provide cybersecurity awareness training to our employees during onboarding and periodically thereafter, including through simulated phishing attacks.

companyName: AlTi Global, Inc.

ticker: ALTI


text: To date, we have not incurred any material losses related to cybersecurity incidents. However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents. See "Part 1, Item IA. – Risk Factors" for more information on the cybersecurity risks facing the Company.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Microsoft cloud ecosystem, including Microsoft 365, Azure, SharePoint Online, Microsoft Defender, and Microsoft InTune, forms the backbone of our cybersecurity infrastructure. These platforms offer advanced security features such as data encryption in transit and at rest, network security controls, identity and access management, and threat protection capabilities. Microsoft's constant investment in cybersecurity research and development ensures that we benefit from cutting-edge security technologies and practices.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Our Cybersecurity program makes a reasonable and ongoing effort to keep pace with a rapidly changing threat and regulatory landscape.

companyName: Fisker Inc./DE


text: Our board of directors oversees the implementation of Hines' cybersecurity risk management program and receives periodic reports from Hines' Chief Technology Officer (the "CTO") and Chief Information Security Officer (the "CISO") regarding the effectiveness of Hines' cybersecurity risk management program. Additionally, our board of directors will receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Based on the information we have as of the date of this Annual Report, we do no t believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. See Item 1A, Risk Factors, of this Annual Report for further discussion of cybersecurity risks.

companyName: ELUTIA INC.

ticker: ELUT


text: Management, including the Chief Financial Officer and CIO, will update the audit committee on our cybersecurity programs, material cybersecurity risks, program assessments and mitigation strategies. The CIO will provide periodic cybersecurity reports that cover these topics and industry developments.

companyName: Venture Global, Inc.

ticker: VG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: Despite network security and back-up measures, our information technology systems are potentially vulnerable to physical or electronic break-ins, computer viruses and similar disruptive problems. Despite precautionary measures to prevent unanticipated problems that could affect our information technology systems, sustained or repeated system failures that interrupt our ability to generate and maintain data could adversely affect our ability to manage our data and inventory, procure parts or supplies or manufacture, sell, deliver ECVs, or achieve and maintain compliance with, or realize available benefits under, tax laws and other applicable regulations.

companyName: Cenntro Inc.

ticker: CENN


text: We perform periodic assessments for identifying threats and vulnerabilities, covering relevant operational facets, and focusing on identifying, analyzing, evaluating, and treating cyber risks across business functions. Our risk assessment guidelines define risk measurement and prioritization, and consider factors such as likelihood, impact, and potential harm. Mitigation strategies are planned, covering technical and procedural measures, including incident response plans.

companyName: INNODATA INC

ticker: INOD


text: Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the DOE to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: ALIMERA SCIENCES INC


text: Management Responsibilities Our cybersecurity program is managed by our Chief Technology Officer ("CTO"). Our CTO has 10 years of experience in information technology and cybersecurity, having been at the Company since 2023. The CTO, along with the Company's IT security partners, is responsible for reducing cybersecurity risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events, responding quickly and building procedures to rapidly recover, if needed.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: As of the date of this annual report, we have not encountered any cybersecurity incidents that have materially affected, or that we believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. We do, however, face risks from cybersecurity threats. For additional information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors of this Form 10-K, including the risk factors under the following heading: "Cyber incidents or attacks could result in information theft, data corruption, operational disruption and/or financial loss."

companyName: Chenghe Acquisition II Co.


text: Our employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding our resources and information. This training is reinforced by testing initiatives, including periodic phishing tests. We also assess the cybersecurity risks presented by third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we maintain business continuity and disaster recovery plans, as well as cybersecurity insurance.

companyName: Knowles Corp

ticker: KN


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of a variety of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: We have a proactive strategy to manage the material risks stemming from cybersecurity threats. Our cybersecurity program follows the Cybersecurity Framework as defined by the National Institute of Standards and Technologies. The Cybersecurity program is the responsibility of our internal IT Security Team, which is overseen by our Director of Global IT Security and Compliance.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Our SVP IT, in coordination with the Company's executive team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the SVP IT oversees the monitoring, prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the Board when appropriate. Our SVP IT has twenty years of experience in the IT field, including managing risks arising from cybersecurity threats. The SVP IT is supported by a staff of IT professionals. Also supporting our SVP IT in assessing and managing the Company's material risks from cybersecurity threats are the Company's COO, CFO, and General Counsel, each of whom have over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Daseke, Inc.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function.

companyName: Marker Therapeutics, Inc.

ticker: MRKR


text: To prepare and respond to incidents, the company has implemented a multi-layered cybersecurity strategy integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information and network security, data management, business continuity and disaster recovery, privacy, third-party risk management, and incident response. The company engages third-party consultants and independent auditors to, among other things, conduct penetration and vulnerability tests, monitor systems, perform cybersecurity risk assessments, and conduct audits.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee responsibility for oversight of risk assessment and risk management, including cybersecurity, and the Company's policies and controls relating to information technology, management information systems, and cybersecurity. The Audit Committee receives quarterly reports from management on our cybersecurity risk management activities. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: To support our preparedness, we have a cybersecurity incident response plan ("CIRP") that we regularly update as business needs and the security landscapes change. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform multiple tabletop exercises across various levels of the Company each year to test our incident response procedures, enhance our resiliency by seeking to ensure business continuity during potential extended digital outages, identify improvement opportunities and increase employee awareness and preparedness. These tabletop exercises focus on various aspects of cybersecurity events, including patient and employee impact, operational resilience and effectiveness and communication coordination.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: We believe our Chief Digital and Technology Officer and Chief Information Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Information Security Officer has experience leading a global digital portfolio for a large multinational corporation and held key leadership roles for a large technology and software company, including overseeing information security, before joining UnitedHealth Group.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: ADP has implemented a cybersecurity program designed to assess, identify, and manage risks from cybersecurity threats. Our cybersecurity policies, processes, and standards are informed by industry practices and by industry frameworks and standards such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization for Standardization information security standards, including those standards for which we do not have a certification, but we do exercise judgment in selecting applicable controls from such framework or standards. Our cybersecurity program includes: • Technical Safeguards. We have implemented a layered approach to defend against cybersecurity threats. We periodically evaluate technical controls through application security assessments, vulnerability management, penetration testing, and security audits. • Incident Management and Response. A global team monitors our key applications and systems 24/7/365 to detect, investigate and respond to anomalies and incidents. This team addresses reported or detected issues by following a defined incident lifecycle and uses an incident management system to record facts, impact and remedial actions taken. We have established a cybersecurity incident response plan and escalation process, outlining processes for responding to incidents from identification to mitigation and notifying members of senior leadership, the board of directors and external advisors, as appropriate. We test our plans and processes through simulation exercises, scenario planning and tabletop exercises, using findings to improve processes. • External and Internal Assessments. We periodically engage assessors, consultants, auditors, and other third parties to evaluate our technology, security, and related controls and benchmark against industry practices. We engage in both internal and external assurance and audit activities across the company multiple times a year including an annual third-party review of our overall cybersecurity program. • Threat Intelligence. We maintain affiliations with cybercrime task forces and other third-party monitoring organizations. In addition, we collaborate with professional security organizations, law enforcement and technology companies to proactively identify malicious activity. • Business Resiliency Program. We have established a global, integrated business resiliency program designed to manage the impacts of technological, environmental, process and health risks on service delivery. This program uses an integrated framework that lays out our mitigation, preparedness, response and recovery process. • Third-Party Risk Management. We maintain a third-party risk management process, designed to identify and manage risks associated with our vendors, our partners and other third parties, that includes conducting security assessments prior to engagement and periodically during the engagement. We also seek to include security and privacy terms, where appropriate, in our contracts with third-party service providers that require third parties to maintain security controls to protect our data and notify us in the event of a cybersecurity incident.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Cybersecurity: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Maitong Sunshine Cultural Development Co., Ltd

ticker: MGSD


text: Our cybersecurity risk management strategy is led by our Chief Information Security Officer (CISO) and a team of information security and other professionals, as detailed further below, who are responsible for implementing and maintaining our cybersecurity data protection practices. This team works in close coordination with the Audit Committee of our Board of Directors, which is responsible for oversight of cybersecurity risk, senior management and other business functions and teams across the Company to identify threats by performing risk assessments and analyzing effectiveness of controls against identified risks.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our Company maintains a comprehensive information technology security program based on the National Institute of Standards (NIST) Cyber Security Framework. The information technology security program aims to protect our Company from cybersecurity threats and ensure the confidentiality, integrity, and availability of our data and systems. To provide such protection, our program implements a significant number of controls, including but not limited to physical and digital access controls, data protection controls, system development controls, acceptable use controls, and monitoring controls. We deploy technical and administrative safeguards, such as firewalls, intrusion prevention and detection systems, anti-malware functionality, and security awareness and phishing prevention training programs, which are regularly evaluated and improved. Further, in the event of a cybersecurity incident, our Company has a Cybersecurity Incident Response Team (the "CSIRT"), consisting of stakeholders from across the Company, to respond appropriately. The CSIRT provides a proactive approach to managing cybersecurity incidents and ensures incidents are controlled as quickly as possible to avoid and minimize the damage to systems, limit impact to client information, protect the Company's reputation and integrity, and prevent future incidents. The Company also has a data incident response plan in place that outlines expected actions in the event of a data security incident. The Company prioritizes protecting and informing customers, clients, and employees in the event of a data security incident, as is appropriate.

companyName: Finance of America Companies Inc.

ticker: FOA


text: The Company also maintains a cyber liability insurance policy. See Item 1 – "Business – Insurance – Cyber Liability Insurance" in this report.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: from Cybersecurity Threats have not encountered cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations or financial condition. Any material cybersecurity incident could have a material impact on our operations by causing a disruption to our ability to function as a global organization, by interrupting our internal and external communications and reporting or managing our operations. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Our operations could be adversely impacted by information technology system failures, network disruptions, or cybersecurity breaches," for additional discussion about cybersecurity-related risks.

companyName: MICROVISION, INC.

ticker: MVIS


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to "Any significant interruption in the operation of our business functions, facilities or systems or our vendors' facilities or systems could result in a materially adverse effect on our operations" and "Any significant breach in our data security infrastructure or our vendors' facilities or systems could disrupt business, cause financial losses and damage our reputation, and insurance coverage may not be available for claims related to a breach" under Item 1A Risk Factors.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors.

companyName: Q32 Bio Inc.

ticker: QTTB


text: Our board of directors, including through delegation to our audit committee, exercises oversight over cybersecurity risks and controls. Our audit committee and board of directors regularly receive updates (including, in the case of our audit committee, quarterly updates) from our Chief Financial Officer, Senior Director of Information Technology, and other members of management regarding the status of cybersecurity initiatives and the effectiveness of our internal control system related to information security. In connection with such updates, our board of directors and audit committee discuss our approach to cybersecurity risk management with management. Additionally, the audit committee periodically receives presentations from third-party cybersecurity experts to remain informed of developments in cyber risk and mitigation. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: The following is a brief list of some of the cybersecurity risk management tools we employ to identify, assess and manage threat risks: –Third party system and network scanning tools that identify or automatically block potential cybersecurity threats; –Routine review and update of system access; –Multi-factor authentication; –Live 24-hour monitoring of corporate and field operations IT networks for cybersecurity threats; –Mandatory annual employee cybersecurity awareness training program that includes phishing simulations and other microlearning courses; –Monthly IT and cybersecurity meetings with management and IT professionals; –Completion of annual IT network cybersecurity assessment and vulnerability scan;

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Easterly Government Properties, Inc.

ticker: DEA