text: The Chief Information Security Officer (CISO) is responsible for overseeing the Company's cybersecurity practices. Our CISO joined Autoliv in 2015. He has 29 years of information technology experience, including six years as CISO. The CISO reports directly to the CFO but, in line with the corporate governance model, the CISO's activities are formally governed through a management board, the "Digitalization and IT Management Board" ("DITM Board") comprised of the Chief Information Officer (CIO) and certain members of Autoliv's Executive Management Team ("EMT") representing engineering, supply chain management, operations and manufacturing, quality and project management, finance, information technology, and divisional teams. The DITM Board meets at least quarterly with cybersecurity as a standing agenda item. In addition to the standing DITM Board meetings, the CISO, when needs arise, meets with the full EMT typically at least semi-annually to report on, or discuss, specific cybersecurity-related topics.

companyName: AUTOLIV INC

ticker: ALV


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information technology team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: PlayAGS, Inc.

secItem: Item 1C


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on June 30, 2023 and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on June 30, 2023 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Golub Capital Private Credit Fund


text: Our Board's responsibilities include, but are not limited to: a. Overseeing effective implementation of cybersecurity initiatives and alignment with our policies and strategies;

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In addition, we have secured cyber insurance coverage, and we plan to regularly review our coverage to align with the evolving nature of cyber threats and industry standards. For more information, see the section titled "Risk Factors— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our security, which could materially affect our results." in Part I. Item 1A. of this Annual Report on Form 10-K.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: Risks from Cybersecurity Threats We have not encountered, to date, cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Our Board of Directors considers cybersecurity risk to be an important potential risk to our business. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee periodically evaluates our cybersecurity strategy to ensure its effectiveness. Management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. Our vendor cybersecurity risk management program supports the planning, automation, and management of cybersecurity risk with enrolled suppliers and other third parties, focusing on risk-based assessments. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including but not limited to the following risks: operational, regulatory compliance, reputational, strategic, information technology, data security and privacy, and market risks such as interest rate, credit, liquidity and price risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Board of Directors is responsible for risk oversight over all significant risks facing the Corporation and fulfills this responsibility mainly through its committees. While our Board of Directors takes an oversight role in cybersecurity risk tolerance, we rely to a large degree on management and outside consultants in overseeing cybersecurity risk management. Our Director of Technology Solutions, who reports directly to our Chief Information Officer, is primarily responsible for this cybersecurity component and is a member of management's Operational Risk and IT Steering Committees, and regularly attends and presents to the Risk Committee of our Board of Directors ("Risk Committee").

companyName: FIRST OF LONG ISLAND CORP


text: Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, refer to Item 1A. Risk Factors – "The Company's operations may be impaired if our information technology systems fail to perform adequately or are the subject of a data breach or cyberattack," which is incorporated by reference into this Item 1C.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Third Parties on Risk Management engage a range of external experts, including consultants, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These engagements are intended to give us access to specialized knowledge and insights to inform our cybersecurity strategies and processes, including industry-standard control frameworks and applicable regulations, laws, and standards.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Currently, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's operations. In addition, the Company successfully completed the first annual cybersecurity audit conducted by TSA under Joint EA 23-01 Cybersecurity-Performance-Based Measures for Airport and Aircraft Operators. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business strategy, results of operations or financial condition.

companyName: Spirit Aviation Holdings, Inc.

ticker: FLYYQ


text: Based on the information we have as of the date of this Annual Report with respect to the periods beginning with those covered by this Annual Report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We, like most technology companies, are the target of cybercriminals who attempt to compromise our systems. We describe risks relating to cybersecurity threats, including as a result of previous cybersecurity incidents in "Item 1A. Risk Factors" in this Annual Report on Form 10-K, under the headings "Our success depends on maintaining the integrity of our systems and infrastructure, which may suffer from failures, capacity constraints, business interruptions and forces outside our control." and "Security incidents expose us to liability and could damage our reputation and our business."

companyName: Sabre Corp

ticker: SABR


text: Engagement of Third-party Support We engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of cybersecurity controls.

companyName: Liquidia Corp

ticker: LQDA


text: Third-Party Service Providers We work with third parties from time to time that help us identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's Chief Financial Officer, the Company's VP of Information Technology, other members of management and the Company's external Chief Information Security Officer.

companyName: Revance Therapeutics, Inc.


text: We have not had any reportable cybersecurity breaches or espionage, including what we may perceive or recognize as cybersecurity incidents, espionage or credible threats during the fiscal year ended December 31, 2024. To date, as a result, there has no t been any material adverse effect on our business operations or financial condition. If there is a cybersecurity attack, espionage and/or an infiltration of our files, data, customer data and the like, there would be a material adverse effect on our business, our reputation, our operations and financial condition. For example, our reputation would be damaged in the event of a cybersecurity infiltration. If there were a cybersecurity infiltration, we could lose access to our data which would disrupt our operations, and we even may not be able to operate. Such a loss of access might be temporary or permanent, and it might be localized or general. The level of disruption will depend on our backup systems. Our clients financial and other data could be taken and used against us to damage our reputation or cause harm to our clients in different ways. In the latter instance, we may be liable for monetary damages to our clients. We may be held for cyber ransom, which would be a loss to our financial resources. Our inability to operate, payment of damages, payment of ransom, and the costs of reparation of our systems, consultants and tangential expenses will all result in damage to our business and our financial resources.

companyName: EXOZYMES INC.

ticker: EXOZ


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our intellectual property.

companyName: CEVA INC

ticker: CEVA


text: The Corporation's cybersecurity risk management policies include physical, administrative and technical safeguards, as well as plans and procedures designed to help the Corporation seek to prevent and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or RCM. In addition, our cybersecurity risk management programs include periodic identification and testing of our vulnerabilities and cybersecurity awareness training. Finally, our Chief Compliance Officer conducts an annual due diligence review, including as to cybersecurity matters, of those third-party service providers that have possession of the Corporation's material non-public information and reports the results of those assessments to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Within Helix's IT department, several IT management positions are responsible for assessing and managing cybersecurity risk, including the Chief Information Officer, Director of Information Technology and Manager of Information Technology. Each of the IT department's management personnel has over 20 years of IT experience. The Director of Information Technology and the Manager of Information Technology positions are tasked with the daily and per incident assessment and management of cybersecurity risks, while the Chief Information Officer is tasked with oversight.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: The Company has a Governance, Risk, and Compliance (GRC) IT function to address enterprise risks; cybersecurity is a category handled by that function. Cybersecurity is a vital pillar within a comprehensive risk management framework, fostering cross-functional collaboration to fortify organizational resilience against digital threats. The Company has a privacy and security governance committee. The company operates a privacy and security governance committee and a cybersecurity team led by a Chief Information Security Officer. With extensive cybersecurity experience across IT services, Telecom, and Manufacturing sectors, the Chief Information Security Officer spearheads cybersecurity risk and strategy and directly reports to the Chief Information Officer. Additionally, as part of our overall enterprise risk management strategy, our Audit Committee, which consists solely of independent directors, oversees cybersecurity and receives updates on cybersecurity matters, which include a review of potential digital threats and vulnerabilities, cybersecurity priorities, and our cybersecurity framework.

companyName: WK Kellogg Co


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third party service providers in the ordinary course of business, including to assist us in performing information security assessments for third party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: The CISO has information technology and information security experience, including enterprise risk management leadership, and holds a Certified Information Security Manager certification from the Information Systems Audit and Control Association (ISACA). The CISO reports to the Chief Information Officer ("CIO"), who is a member of the Company's Executive Management Team ("EMT") and reports directly to the CEO. The CIO has extensive experience overseeing and executing technology strategies and implementations in complex, global organizations.

companyName: Hillenbrand, Inc.

ticker: HI


text: Our Chief Security & Risk Officer supervises efforts to prevent, detect, mitigation and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment. Our Chief Security & Risk Officer is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for leading our overall cybersecurity risks management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Chief Security & Risk Officer has significant global experience in managing and leading IT and cybersecurity teams.

companyName: PARSONS CORP

ticker: PSN


text: with the assistance of IT support plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings to the Audit Committee as needed. These briefings encompass a broad range of topics, including any emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events that may occur.

companyName: LogicMark, Inc.

ticker: LGMK


text: Our Board of Directors has a process in place to monitor management's oversight of cybersecurity. This is done primarily through regular reports to its Risk Committee as well as the full Board of Directors. Management provides reports on our cybersecurity risk management program, including our risk evaluation, the results of independent third-party security assessments, and our efforts to manage cyber related risks.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity breaches, cyberattacks, and other disruptions to information technology systems could disrupt our operations, compromise the confidentiality of our data or our intellectual property, and adversely affect our business, reputation, operations, and financial results" and "Our business may be impacted by information technology system failures or network disruptions, and lack of redundancy."

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We maintain Information Systems Incident Management Standards that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A "Risk Factors -Cybersecurity and Technology Risks.

companyName: Bally's Corp

ticker: BALY


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Toughbuilt Industries, Inc


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – "Our internal information systems, or those of any of our CROs, contract manufacturers, service providers, other contractors or consultants or potential future collaborators, may fail or suffer cybersecurity incidents or breaches, which could result in a material disruption of our product development programs."

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: Cybersecurity incidents may occur at, or be reported to, any of the Company's facilities worldwide. The Company has an IT Service Desk which acts as the single point of contact for cybersecurity incident reporting. Employees can notify the IT Service Desk of any event that they observe or is reported to them that may constitute a cybersecurity incident. Once notified, the IT Service Desk team conducts an initial classification and escalates, when needed, to the CISO and other members of ISIRT as per the Company's IRP. Financial Ops, in consultation with the General Counsel, CPO and CISO, decide whether to activate the ISIRT in connection with any escalated incident. When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances. As of December 31, 2023, no identified risk has required activation of the ISIRT.

companyName: BRUKER CORP

ticker: BRKR


text: The corporate information security organization has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats, and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement (DFARS) related to adequately safeguarding controlled unclassified information (CUI) and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance. Moreover, we continue to work with the DoD on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. For example, we have worked in collaboration with the other members of the defense industrial base to support DoD's development of the Cybersecurity Maturity Model Certification (CMMC) program, DoD's program to ensure members of the defense industrial base meet cybersecurity requirements for handling CUI and federal contract information. We believe we are well positioned to meet the requirements of the CMMC and are preparing for certification once the requirements are effective. In addition to following DoD guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. For example, we use a proactive risk management strategy that we developed and implemented called the Intelligence Driven Defense model that seeks to identify and prevent cybersecurity incidents by understanding the nature of adversaries and using this information to minimize the impact of an attack.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: While the Company has seen attempts to gain access to its systems, and expects such attacks to continue, or possibly intensify in the future, the Company has not experienced any material losses relating to cyber-attacks or other information security breaches as of December 31, 2024. As a protective measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, or by one or more of the Company's third-party providers, however such insurance coverage may not be sufficient to cover all losses incurred. As of the date of this Report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion surrounding risks from cybersecurity threats, refer to the section captioned "Risks Related to Information Security and Technology" within Part I. Item 1A of this Report.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: We engage consulting firms and other third parties in connection with our cybersecurity risk management processes. For example, third parties are engaged from time to time to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Board of Directors, the Audit and Compliance Committee of the Board of Directors and/or our management team regarding cybersecurity matters.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: The Company's Chief Information Officer leads the overall cybersecurity strategy and risk management program. This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team. Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning. The IT department executes daily security tasks such as vulnerability scanning, threat detection, and incident response. The Chief Information Officer and IT security team provide regular reports to senior management on the Company's cybersecurity posture, identified vulnerabilities, and ongoing incident management activities. Management provides the Audit Committee with quarterly updates on the Company's cybersecurity practices.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Key aspects of our cybersecurity risk management and threat mitigation strategy include: • Maintaining our ISO/IEC 27001:2022 certification and using it along with other common security frameworks to help assess, identify, and manage material risks from cybersecurity; • Utilizing dedicated IT Security Operations and Product Security teams focused on monitoring, enforcing and improving cybersecurity throughout the enterprise; • Engaging and training internal stakeholders from representative aspects of the business (product and functional teams) on our Incident Response and Reporting plan on a quarterly basis; • Maintaining and regularly testing our disaster recovery and business continuity plans; and • Creating information security awareness among our employees and partners through the use of phishing exercises and regular cyber-awareness articles & newsletter campaigns.

companyName: SEMTECH CORP

ticker: SMTC


text: The Audit Committee of the Board of Directors oversees our cybersecurity program and management of the associated risks. The Audit Committee periodically receives updates regarding our cybersecurity program through meetings with and reports from our CIO and CISO (or their designees).

companyName: HERC HOLDINGS INC

ticker: HRI


text: To accomplish this purpose, the information technology and security committee has five primary responsibilities: • understanding the security controls and assessments conducted on our major payment platforms and comparing them to industry best practices; • evaluating strategies to protect our intellectual property; • assessing opportunities to update our processing platform strategies to ensure the long term use of our resources; • reviewing progress on significant IT security and cybersecurity projects and evaluating effectiveness of projects; and • overseeing our disaster recovery and business continuity plans.

companyName: CORPAY, INC.

ticker: CPAY


text: To support our cybersecurity risk management processes, we leverage a third-party Information Security Coordinator who provides ongoing support for the protection of our information technology infrastructure and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response. Additionally, our cybersecurity risk management strategy is informed by a recent risk assessment conducted by a third-party cybersecurity consultant.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: Management's Role in Cybersecurity Risk Management Diameter's Chief Compliance Officer and Chief Operating Officer oversee Diameter's cybersecurity operations, with the assistance of additional personnel and Diameter's external managed service provider. Employees that support Diameter's cybersecurity infrastructure have relevant educational and industry experience, including in technology and cybersecurity risk. Assessment of Cybersecurity Risk Diameter conducts annual cyber risk assessments, and penetration tests are conducted by third-party service providers.

companyName: Diameter Credit Co


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition, to date. However, we face ongoing and increasing cybersecurity risks, including from threat actors that are becoming more sophisticated and effective over time, and we can provide no assurance that there will not be incidents in the future or that past or future threats or incidents will not materially affect us, including our business strategy, results of operations, or financial conditions. For additional information regarding these risks, please refer to Part I, Item 1A, "Risk Factors," in this Form 10-K, including, but not limited to, the risk factor entitled "A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results. "

companyName: Palo Alto Networks Inc

ticker: PANW


text: Our Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: ENZO BIOCHEM INC


text: 2. Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis. Additionally, our Chief Financial Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: We have policies, standards, processes and practices for assessing, identifying, and managing material risk from cybersecurity threats that are integrated into our ERM systems and processes. Our cross-functional approach to cybersecurity risk management is focused on preserving the confidentiality, integrity, and availability of our information systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As part of this approach, we have implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents to enable timely decisions by management regarding the public disclosure and reporting of such incidents.

companyName: TWILIO INC

ticker: TWLO


text: At the Company level, the Company's Board oversees and monitors enterprise risk management at the Company, including with respect to cybersecurity and information security risk. The Company's Board and disclosure review team are expected to receive periodic reports and updates from the Head of IT, as applicable in the context of risks from cybersecurity threats that may impact the Company. STEP has a framework under which certain cybersecurity incidents are escalated within the Company and STEP and, where appropriate, reported to the Company Board, STEP Board or Audit Committee in a timely manner.

companyName: Stepstone Private Credit Fund LLC


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during separate Board meeting discussions of important matters like risk management, and other relevant matters. Management or the Audit Committee will provide a comprehensive update to the Board on cybersecurity threats and risk mitigation generally at least annually, and more frequently as relevant.

companyName: Talkspace, Inc.

ticker: TALK


text: The Cybersecurity Working Group maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident and is designed to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders (including the Board for certain incidents) informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by an incident and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.

companyName: WELLTOWER INC.

ticker: WELL


text: Board is responsible for the oversight of our Manager, who, pursuant to the Management Agreement, is responsible for overseeing our risk management processes, including cybersecurity risks. Our Board recognizes the critical importance of maintaining effective cybersecurity measures and our Manager's role in assessing and managing our material risks from cybersecurity threats. Our Manager provides our Board with timely updates both on a periodic basis and as new cybersecurity risks arise.

companyName: Belpointe PREP, LLC

ticker: OZ


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the Company's Chief Executive Officer ("CEO") for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Following these risk assessments, if necessary, we implement and maintain reasonable safeguards to minimize identified risks and regularly monitor the effectiveness of our safeguards. We devote significant resources, including engaging experienced consultants and designate senior-level information technology management ("IT management") to manage the risk assessment and mitigation process. Personnel tasked with managing cybersecurity risks periodically report to senior management and the Audit Committee. We use automated tools and trained personnel to maintain real-time threat monitoring and 24x7 alerting of all of our IT infrastructure and endpoints. We leverage various software tools, internal personnel and consultants to identify, triage, escalate and remediate threats. In the event of a security incident, we follow communication protocols to alert senior-level management as to the nature and severity of the threat while leveraging consultants and forensic tools to contain, document and mitigate the threat.

companyName: RxSight, Inc.

ticker: RXST


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: AI Era Corp.

ticker: AERA


text: The Company also requires cybersecurity training for all active employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides quarterly cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through several methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: The VP, Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Canopy Growth Corp

ticker: CGC


text: We also maintain an inter-departmental privacy and security committee which oversees programs and initiatives to protect and secure patient information as well as our data and information systems. This committee reports to our executive management team and has responsibility for our IT-security incident response plan and various training and awareness programs that promote patient privacy and system security practices by employees.

companyName: Enhabit, Inc.

ticker: EHAB


text: Our cybersecurity function, led by our Head of DevSecOps and supported by our Head of IT and third-party service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of our threat environment, evaluating our and our industry's cybersecurity risk profile, evaluating threats reported to us, completing internal and external cybersecurity audits, completing third-party cybersecurity threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and completing third-party red/blue team exercises and tabletop incident response exercises.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: We have engaged a range of external experts including consultants and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These engagements are intended to give us access to specialized knowledge and to inform our cybersecurity processes including industry-standard control frameworks and applicable regulations, laws, and standards. Prior to entering into any agreements with third-party providers, comprehensive security assessments will be conducted, accompanied by continuous monitoring to verify adherence to our cybersecurity criteria. This involves quarterly evaluations conducted by our management team and ongoing assessments by our team. Such measures are planned to mitigate the threats of data breaches or other security breaches stemming from third-party service provider. We have not encountered cybersecurity issues that have significantly impacted our operational performance or financial status.

companyName: Leet Technology Inc.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we intend to evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: The Chief Operations & Technology Officer, among other duties, is responsible for the security and integrity of infrastructure, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the vCISO and our risk management department. Our Chief Operations & Technology Officer has over 25 years of relevant experience in information technology and information security, building and leading technical organizations of various sizes, including in the banking industry. The vCISO has served in various roles in information technology and information security for 20 years, and holds multiple certifications relevant to cybersecurity, including CMMC (Cybersecurity Maturity Model Certification) and Fortinet NSE (Network Security Expert) level 3.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Although we have taken significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As of December 31, 2024, management has determined that none of the cyberattacks we have experienced, individually or in the aggregate, have had a material adverse effect on our business, financial condition, or results of operations, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information about these risks, see the risk factor titled " Risks associated with information technology can expose Brink's to business disruptions, cybersecurity breaches and regulatory violations" under Item 1A of this Annual Report on Form 10-K and incorporated by reference herein.

companyName: BRINKS CO

ticker: BCO


text: The Audit Committee of our Board of Directors oversees cybersecurity risk management as part of its risk oversight function and oversees the design and effectiveness of management's implementation of our cybersecurity risk management program, procedures, and contingency plans. Senior management plays a critical role in informing the Audit Committee on cybersecurity risks. More specifically, the information technology department regularly informs executive management, including the Chief Executive Officer, Chief Financial Officer and General Counsel, on all aspects pertaining to cybersecurity risks and incidents; and the Audit Committee receives periodic reports from executive management, senior information technology leadership, and risk management personnel on our cybersecurity and information security risks and postures on a regular basis. These periodic reports include detailed updates on our activities preparing for, preventing, detecting, responding to, and recovering from cyber incidents, if applicable.

companyName: HURCO COMPANIES INC

ticker: HURC


text: Ginkgo integrates risk management into its overall cybersecurity strategy, and has implemented processes designed to identify, assess, prioritize and manage risks to protect Ginkgo's data, intellectual property and information assets. As part of our risk governance and management, Ginkgo has developed processes designed to: identify and assess risks, evaluate those risks against pre-defined criteria, develop and implement strategies to address identified risks, monitor and review those risks and communicate risks to relevant stakeholders. Identifying Ginkgo's cybersecurity risks involves a multifaceted approach that encompasses both internal assessments and external information sources. For example, we use security audits conducted by internal and external auditors to assess compliance with security policies and industry frameworks; vulnerability assessments to discover vulnerabilities in networks, systems and applications; penetration testing using simulated cyberattacks to test the resilience of systems and identify weaknesses; and risk assessment processes to evaluate IT infrastructure, including using a risk register to identify risks, likelihood of their occurrence, potential impact, and remediation. We also oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: As part of our risk management process, the Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: The Company's PFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's PFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The Company relies on technology infrastructure and information systems, including the Internet and cloud services, to process, transmit and store electronic and financial information, manage a variety of business processes and activities, and comply with regulatory, legal and tax requirements. The Company also depends on its information technology infrastructure to capture knowledge of its business including its vessel operation systems, which contain information about vessel positioning and scheduling; monitor its vessel maintenance and engine systems; coordinate its business across its bases of operation including cargo delivery and equipment tracking; and communicate within its organization and with customers, suppliers, partners and other third parties. The Company's ability to service customers and operate vessels is dependent on the continued operation of these systems. While the Company takes various precautions and has enhanced controls around its systems, like other technology systems, they are susceptible to damage, disruptions or shutdowns, hardware or software failures, power outages, computer viruses, telecommunication failures, user errors, catastrophic events, or cyber-attacks including malware, other malicious software, phishing email attacks, attempts to gain unauthorized access to its data, the unauthorized release, corruption or loss of its data, loss or damage to its data delivery systems, ransomware, and other electronic security breaches. Over time, these attacks have become increasingly sophisticated and, in some cases, have been conducted or sponsored by "nation state" operators. The Company expects that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Our Manager has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: At least quarterly, our cybersecurity team provides a report to our Nominating and Governance Committee and, at least annually, to the full Board regarding our technology and cybersecurity risk profile, programs and key initiatives, including the maturity of our cybersecurity framework and how we compare to selected industry benchmarks.

companyName: Cable One, Inc.

ticker: CABO


text: We utilize the National Institute of Standards and Technology ("NIST") framework with our security program to identify, mitigate, and manage cybersecurity risks. We have implemented controls and a formal security policy following this framework. This security policy functions in conjunction with other policies, such as our acceptable use policy and our mobile device policy. We also maintain a specific incident response policy and procedure document including notification and participation of key workforce personnel and external stakeholders to contain, eradicate, and recover from any security incidents.

companyName: FreightCar America, Inc.

ticker: RAIL


text: We are committed to protecting our critical information and data and information technology environment and defending against cybersecurity threats. We focus on relevant areas of cybersecurity risks and vulnerabilities and seek to mitigate such risks by maintaining secure environments, maintaining processes to identify cybersecurity threats and raising awareness of cybersecurity risks to our employees.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Key components of our Cybersecurity risk management program include the use of third-party service providers, as appropriate, to assess, test, or otherwise assist with aspects of our security processes. For example, we employed a third-party cyber risk consultant to assess our overall Cybersecurity risk framework against NIST standards. We have also engaged third-party experts to perform penetration testing of our IT systems, and we have considered the results of such tests to enhance our Cybersecurity systems and controls, as appropriate.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate the Business Combination. However, because we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: Cantor Equity Partners I, Inc.

ticker: CEPO


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies at least annually. Additionally, the Technology Committee of our board of directors reviews our cyber security risk profile on at least an annual basis.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We perform regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists, and engage independent auditors to periodically review our cybersecurity program, including our process, systems, and control effectiveness, and provide recommendations to continuously strengthen our program. Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness. For additional discussion, on cybersecurity risk, see Item 1A. Risk Factors, section 1.08 "Unauthorized disclosure of sensitive or confidential information, whether through a cyber-attack, or breach of our computer systems or any other means, severely harm our business."

companyName: SIERRA BANCORP

ticker: BSRR


text: Our Board of Directors, along with our information Technology Committee, which is comprised of key senior managers, are actively involved in providing oversight of our cybersecurity program. Monthly updates are provided to our Board regarding the status of our program, including key monitoring metrics and trends noted both internally and within our industry. Our Board reviews and approves all cybersecurity-related risk assessments, polices and formalized reviews performed throughout the year.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: We collaborate with third parties to assess the effectiveness of our cybersecurity risk program and have assessed it against the National Institute of Standards and Technology ("NIST") cybersecurity framework. In addition, we consider the internal risk oversight programs of third-party service providers with whom we engage in order to help protect us from any related cybersecurity vulnerabilities.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences." utilize information technology for internal and external communications with vendors, clinical sites, banks, investors and shareholders. Loss, disruption or compromise of these systems could significantly impact operations and results.

companyName: Gamida Cell Ltd.


text: Our cybersecurity risk management program categorizes cybersecurity risks into five distinct areas: identify, protect, detect, respond, and recover, as defined by the National Institute of Standards and Technology Cybersecurity Framework. We regularly assess the evolving cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: Service Provider Arrangements Management identifies, assesses, controls, monitors and reports on risks related to the Bank's use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Interagency Guidance on Third-Party Relationships: Risk Management.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: The Board has established oversight mechanisms to govern risks associated with cybersecurity threats because they recognize the significance of these threats to the Company's operational integrity and stakeholder confidence.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: We have been subject to attempted cybersecurity attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. For information about cybersecurity risks to our business, see Item 1A. Risk Factors and the risk factor titled "Our operations are subject to risks beyond our control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information." WEC Energy Group, Inc.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: Although we have not experienced a material cybersecurity incident, like other organizations in our industry, we face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. For more information about the cybersecurity risks we face, see the section entitled "Risk Factors — Risks Related to Information Technology and Data Privacy".

companyName: Prime Medicine, Inc.

ticker: PRME


text: Our Advisor's information technology and internal audit teams utilize frameworks consistent with well-recognized industry cybersecurity frameworks to identify and mitigate information security risks and oversee an active cybersecurity training program.

companyName: Net Lease Office Properties

ticker: NLOP


text: Information security and privacy are an important part of our culture and foundational to our goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: The Company's CRO has over 27 years of experience in cybersecurity and information technology. The CRO joined the Company in 2011 and became CRO in July 2023. Prior to becoming CRO, he served as SVP and Director of Information Security & ERM for six years and prior to that served five years as Vice President and Senior Information Security Officer of the Company. Prior to joining the Company, the CRO had a ten year career in information technology and began his career serving with the United States Air Force, specializing in information technology, cybersecurity, risk mitigation, and encrypted communications.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: As part of our processes for assessing, identifying and managing material risks from cybersecurity threats, we maintain a process to enhance security and optimize our IT systems, and regularly conduct security assessments and testing of our systems to verify our systems' integrity to protect them against being compromised from both internal and external sources. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner. These efforts include using monitoring tools and services to address the confidentiality, integrity, and availability of our assets and data. Regular internal and third-party reviews are performed on our processes and technologies to help validate the effectiveness of our privacy and data security controls. These safeguards include employing firewalls, intrusion prevention and detection systems, and access controls, which are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: Perella Weinberg Partners

ticker: PWP


text: We have developed and implemented an enterprise-wide cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvement of our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: FORWARD-LOOKING STATEMENTS AND PROJECTIONS This Annual Report on Form 10-K and the information we are incorporating by reference contain statements that constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. Words such as "will," "expect," "anticipate," "intend," "may," "could," "should," "plan," "project," "forecast," "believe," "estimate," "guidance," "outlook," "trends," "goals" and similar expressions generally identify these forward-looking statements. Forward-looking statements include, among other things, statements relating to our future financial condition, results of operations and/or cash flows. Forward-looking statements are based upon assumptions, expectations, plans and projections that we believe to be reasonable when made, but which may change over time. These statements are not guarantees of future performance and inherently involve a wide range of risks and uncertainties that are difficult to predict. Specific risks that could cause actual results to differ materially from those expressed or implied in these forward-looking statements include, but are not limited to, those identified under "Risk Factors" and other important factors disclosed in this report and from time to time in our other SEC filings. These risks and uncertainties are amplified by the global macroeconomic, security and political environments, including inflationary pressures, labor and supply chain challenges, which have caused and will continue to cause significant challenges, instability and uncertainty. They include:

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, the IT security team that is responsible for managing our cybersecurity risks has over 50 years of experience in mitigating cybersecurity risks.

companyName: Erasca, Inc.

ticker: ERAS


text: The Company's cybersecurity program fundamentally aligns with the COBIT framework. This is reflected in our related policies, practices and procedures. We have multiple layers of security controls as well as a third-party SOC that helps identify, avoid and mitigate cybersecurity threats. The evaluation of risks includes consideration of cybersecurity and privacy risk, including (1) potential impact on the Company's employees, customers, and other stakeholders, (2) intelligence briefings on notable cyber events impacting the industry and (3) evaluation of external threats. The Company utilizes internal and third-party assessment tools and tests to evaluate its cyber risk policies, practices and procedures as well as to challenge how its defenses are built and deployed. These assessments provide opportunities for critical self-analysis, constructive feedback from third parties, and learnings from industry experts to enhance cyber resilience. Both formal and informal cybersecurity awareness trainings are provided to employees to help identify and avoid cybersecurity threats and to ensure employees understand the Company's cyber risk management policies along with the key role they play to ensure cyber hygiene. The Company has established a cybersecurity incident response team that includes the CEO, CFO, VP of HR, IT Director and other personnel. The Company has also retained counsel to advise on cybersecurity matters.

companyName: RGC RESOURCES INC

ticker: RGCO


text: We have developed cybersecurity training for employees concerning cybersecurity risk. This training provides information on security awareness and phishing simulations. All employees are required to attend periodic cybersecurity training. On a regular basis, our IT team shares news and articles related to cybersecurity awareness with all employees.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: The members of senior management involved in managing our material risks from cybersecurity threats, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary are experienced in data security matters and financial reporting matters. Our Chief Information Security Officer has more than 20 years of experience in information technology and has served in multiple technology executive roles, including security-compliance-related roles and holds a degree in Computer Information Systems from Harding University. Our Chief Technology Officer holds a computer science degree and Master of Engineering in Computer Science from Massachusetts Institute of Technology and has held engineering roles in multiple financial technology companies. Our Cybersecurity Operations Director holds a Master of Science degree in computer engineering as well as a Master of Science degree in information assurance, both from Iowa State University. He has led the security operations centers for large, global data management software company, as well as a large payment processing company. Additionally, he has led audits and penetration tests as the senior manager of a consulting company. Prior to entering into the private sector, he served as a police officer where he was a detective, specializing in computer crimes and forensics. Our Chief Financial Officer has over 30 years of experience in financial statement reporting and auditing. Our General Counsel has significant experience advising on cybersecurity matters and data protection matters and building out cybersecurity and data privacy compliance program across business lines in the financial services industry.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: Our Technology Group, in collaboration with the leading cybersecurity providers, monitors material cybersecurity and overall technology platform risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.

companyName: MARINEMAX INC

ticker: HZO


text: Training and Awareness We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats. We have created an Incident Response Plan that provides our support team with a clear framework for effectively responding to significant incidents.

companyName: Holley Inc.

ticker: HLLY


text: The Company's CL&AO has formal education in information technology and computer science, and extensive experience over 30 years leading information systems and network security functions, centered on technology-intensive telecommunication companies and electronics manufacturers. Our CL&AO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.

companyName: Kimball Electronics, Inc.

ticker: KE


text: In accordance with our Incident Response Plan, in the event of a potentially material cybersecurity event, the Audit Committee as well as our General Council, Chief Financial Officer, and CEO would be notified, briefed, and involved in oversight of mitigation, reporting, and recovery measures as appropriate.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our company recognizes the critical importance of cybersecurity in our digital operations and has established a risk management program to address both internal and external cybersecurity threats. We acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL


text: Annual external cybersecurity and compliance assessments are conducted for the identification, prioritization, and remediation of cyber-related risks to the company's information systems and data. Ongoing internal risk assessments are conducted to ensure protective and detective security controls perform as expected.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: We implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, but not limited to: • technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and • organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company's cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of our policies, standards, processes and practices designed to address cybersecurity threats and incidents; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Additionally, our commitment to security best practices is evident in our implementation of privileged access management, security awareness training for all employees, dark web monitoring, and 24x7 threat monitoring.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: As of December 31, 2023, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We are committed to investing in cybersecurity and to enhancing our internal controls and processes, which are designed to help protect our systems and information. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — "Risk Factors".

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Despite these steps, however, our information technology systems have in the past been and in the future will likely be subject to increasingly sophisticated cyber attacks. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to Linde or our employees and customers or suppliers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on Linde's operations, reputation and financial results. To date, such attempts have not had any significant impact on Linde's operations or financial results.

companyName: LINDE PLC

ticker: LIN


text: Our primary business involves investments in mortgages and mortgage instruments, but we do not perform mortgage servicing, maintain customer accounts, or provide any direct mortgage lending. Nor do we receive personal information on individual mortgage borrowers as part of our regular operations. However, our business is highly dependent on the availability of information systems, and a cybersecurity incident, if one were to occur, could have the potential to disrupt our operations. To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, our operations, business strategy, or financial condition. As discussed more fully under Risks Related to Our Business Operations in Item 1A. Risk Factors of this Form 10-K, given the evolving nature and increasing sophistication of cyber threats, there is no guarantee that future incidents will not have a material impact. While we continuously assess, identify, and mitigate cybersecurity risks through policies, procedures, and industry-standard security measures, cyber threats remain dynamic and could potentially disrupt our operations, expose us to legal or regulatory liabilities, or cause reputational harm.

companyName: AGNC Investment Corp.

ticker: AGNC


text: Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assessed our cybersecurity risk based on the Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our board of directors are responsible for the oversight of risks from cybersecurity threats. At least annually management reports to our board of directors about such risks. Our chief financial officer, Thomas Chesterman, has direct management responsibility in assessing and managing such risks. Mr. Chesterman has prior academic and professional experience in cybersecurity.

companyName: SenesTech, Inc.

ticker: SNES


text: We use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks with our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing, and are tracked and reported.

companyName: SANDY SPRING BANCORP INC


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for oversight of the Company's cybersecurity risk. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director Infrastructure, Operations and Cyber Security who has fifteen years of experience in the industry and oversees the Company's infrastructure, operations and cyber security, and our Vice President of Legal, who has expertise in legal, compliance and privacy matters.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Notwithstanding the approach we take to cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of risks related to cybersecurity threats.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: Our executive team, primarily consisting of Chief Accounting Officer, Chief Financial Officer, and Chief Executive Officer, in conjunction with our information security team and third-party consultants, is primarily responsible in assessing and managing our material risks from cybersecurity threats. The qualifications of our executive and information security teams include a combination of formal education, current trainings and certifications in systems, network, and cybersecurity and over 50 years of combined experience in information technology and cybersecurity matters.

companyName: Innoviva, Inc.

ticker: INVA


text: The audit committee receives periodic reports from the Director of Information Technology and Senior Vice President, Corporate Operations and Legal, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Kronos Bio, Inc.


text: On behalf of the Trust, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to Trust. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the American Institute of Certified Public Accountant's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Trust. The results of these consulting engagements are shared with the Sponsor as part of periodic reports.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, our cybersecurity program is led by the Director of Information Technology (" Director of IT "), who reports to the President and COO. Our Director of IT has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint and attends training in cybersecurity and risk mitigation.

companyName: EACO CORP

ticker: EACO


text: Our board of directors provides comprehensive oversight of enterprise risk management, including information security, technology and cybersecurity threats. The audit committee of our board of directors is responsible for evaluating the adequacy and effectiveness of internal controls, particularly those designed to assess, identify and manage material cybersecurity risks. The audit committee receives quarterly cybersecurity reports from the Chief Information Officer ("CIO") and cybersecurity team, detailing material risks, threats and mitigation efforts. In the event of a cybersecurity incident, the Global Director of Cybersecurity or senior IT leadership will escalate the issue to the Disclosure Committee, following the Incident Response Plan's predefined escalation criteria. Security incidents are classified based on severity (Critical, High, Medium), impact, and nature, ensuring efficient risk prioritization, resource allocation and incident response management.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: We require key third-party service providers to certify that such providers have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.

companyName: HARMONIC INC.

ticker: HLIT


text: We face risks related to cybersecurity such as unauthorized access to information or information technology systems, cybersecurity attacks, and other cybersecurity incidents. Our processes to identify, assess, and manage material cybersecurity risks are informed, in part, by industry cybersecurity standards, including components of the National Institute of Standards and Technology Cybersecurity Framework, ISO 27001 standard, and HIPAA security regulations. Our processes include assessments to identify key risk areas and inform our overall cybersecurity strategy and cybersecurity assessments in connection with our review of key information technology systems. Our processes also include technical security controls, such as network monitoring tools and multi-factor authentication, where appropriate.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: We manage the cybersecurity risk under our Enterprise Risk Management ("ERM") program, where we assess key risks within the Company. The board of directors is responsible for oversight of the Company's enterprise risk management and is informed of the risks associated with cybersecurity through periodic ERM updates. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, and other exercises focused on evaluating the effectiveness of the Program.

companyName: Chemours Co

ticker: CC


text: Our Chief Information Security Officer ("CISO") is the individual that reports to our CIO and provides day-to-day oversight of our cybersecurity program; our CISO additionally leads our cybersecurity program's ongoing evolution. Our CISO is responsible for assessing and managing risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees direct reports and leverages a multi-disciplinary team that regularly communicates with respect to our prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The team consists of individuals that represent various organizations and departments across the Company who have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the Company's disclosure teams relating to potentially material cybersecurity incidents, attends the Company's disclosure committee meetings, and regularly discusses with the Audit Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks. Our CISO has served in this role since March 2024. Our CISO has over 11 years of experience in senior technology roles with cybersecurity responsibilities, and more than 20 years of experience in technology and security. Our CISO holds an MBA; in addition, he holds a Bachelor of Computer Science degree and a Bachelor of Mathematics degree.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: The IT Risk team uses an asset-based risk approach for evaluating cybersecurity risks and appropriate risk mitigation. All IT assets are reviewed against a broad range of risks twice a year and are evaluated for likelihood of occurrence and impact should they occur. These risks are then mapped to our global inventory of systems and the type of data as well as the number of systems to which a risk applies are evaluated. These factors are used to determine a risk score for each of the reviewed risks, and mitigations are subsequently applied to reduce those risk scores to determine the areas of focus for increasing mitigations. This exercise is logged biannually to monitor improvement.

companyName: Mistras Group, Inc.

ticker: MG


text: A role of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our management is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk function in coordination with the oversight and periodic review of the audit committee. In the event of a cybersecurity incident impacting us, management will report to our board of directors and provide updates on management's incident response plan for addressing and mitigating any risks associated with such an incident.

companyName: Peraso Inc.

ticker: PRSO


text: While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: NEXTNAV INC.

ticker: NN


text: A monitoring and detection system has been implemented to help identify cybersecurity incidents. The IT Security Department is tasked with monitoring certain network activities, logs, and system behavior, leveraging threat detection technologies. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to follow industry best practices and aligns with legal and regulatory requirements. This plan is designed to provide for immediate action to contain the incident, mitigate the impact, and restore normal operations efficiently.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: AMN's Privacy function, which reports up through our Chief Legal Officer, works collaboratively with the Information Security function to create and review policies, standards and processes. In addition to updating the Audit Committee, the CIO and Vice President, Information & Security, and Privacy team provide regular updates to the Corporate Governance and Compliance Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: Our cybersecurity program efforts are directed by our CISO who, with the support of the Chief Financial Officer, the Chief Product Officer, and the Chief Legal Officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 28 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.

companyName: Elastic N.V.

ticker: ESTC


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. methods are used to protect sensitive data.

companyName: Prairie Operating Co.

ticker: PROP


text: InterDigital evaluates cybersecurity risks as part of our overall enterprise risk management. A cybersecurity steering committee of senior executives is responsible for assessing and managing cybersecurity risks. The steering committee meets annually to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. The steering committee is led by the Director of Cybersecurity & Networks, a cybersecurity professional with 20 years of experience and industry-recognized certifications. The Director of Cybersecurity & Networks reports directly to the Chief Information Officer ("CIO") and manages our cybersecurity team, which uses multiple internal and external sources to keep up to date on the latest threats and risks and manages a process to evaluate cybersecurity risks associated with third-party service providers.

companyName: InterDigital, Inc.

ticker: IDCC


text: We regularly review our cybersecurity defenses to assess our vulnerability to cybersecurity attacks from viruses, malware and more sophisticated and targeted cyber-related attacks such as hackers looking to demand ransomware or access our systems to obtain information and data, as well as our vulnerability to cybersecurity failures resulting from human error and technological errors. We rely upon internal IT personnel working in conjunction with specialized outside security consultants on a day-to-day basis to conduct reviews and upgrade our systems when determined to be necessary.

companyName: MedWellAI, Inc.

ticker: MWAI