text: Management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: To evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework. We periodically (i) have external experts complete assessments of Centrus' cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.

companyName: CENTRUS ENERGY CORP

ticker: LEU

secItem: Item 1C


text: We have a multi-layered approach to assess, identify and manage material risks from cybersecurity threats. This approach includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other cybersecurity incidents or vulnerabilities affecting the data.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: Education and Awareness Our policies require each of our employees to complete annual information security training, in addition to other training requirements. The result is an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters. These training efforts are supplemented with regular corporate-led communications and outreach initiatives to facilitate cybersecurity awareness and ensure employees remain vigilant and informed about cybersecurity threats and trends.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We understand the importance of cybersecurity in maintaining the confidentiality, integrity, and availability of our systems and data. Our business operations leverage information technology infrastructure and third-party vendors and systems which makes us susceptible to various cyber threats. We have implemented a comprehensive cybersecurity risk management program to mitigate these risks and safeguard our assets.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: The Company's information security program is designed to protect the security of our computer systems, networks, software and information assets, including customer information. The program is comprised of technical controls, policies, guidelines, and procedures. These technical controls, policies, guidelines, and procedures are intended to align with regulatory guidance, and common industry standard security practices.

companyName: FIRST BANCSHARES INC /MS/


text: Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures. Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition. Such significant cybersecurity incidents include, but are not limited to: • ransomware infiltrating our critical systems resulting in production delays and/or loss of critical information; • cyber theft of our IP; • cyber theft of employee and family member, customer and/or patient information; • cyberattack on a critical partner that disrupts our supply chain and/or services; and, • cyberattacks that significantly impact our brand perception.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Role of Management/Board The IT Officer reports to the Chief Executive Officer and leads our cybersecurity program. Our IT Officer has over ten years of experience in information security strategy and the management of cybersecurity risk. The internal Aquestive IT team has over fifteen years of technical experience, program management and architecture experience in managing cyber risk and information security. In addition, the Audit Committee of the Board oversees Aquestive's cybersecurity risk exposures. The IT Officer briefs the Audit Committee on the effectiveness of Aquestive's cybersecurity program quarterly with a more in depth review done annually. In addition, cybersecurity risks are also reviewed as part of our overall Enterprise Risk Management program. We have not encountered any cybersecurity threats or incidents that have had a material impact on our business.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: Any identified cybersecurity incidents must be reported to the ISO and the mitigation and remediation thereof is performed by the Incident Response Team, which is led by the ISO and composed of key executives, with identified call trees and key service providers to support the coordination of a rapid response.

companyName: OFG BANCORP

ticker: OFG


text: Protecting our technology platform and the data that our guests and hosts share with us is critical to our business. We maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management processes. We employ privacy, safety, and security professionals to oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with cybersecurity expertise across multiple industries, including our CTO, VP of Engineering, and head of information technology. Our executive leadership team, along with input from these teams, is responsible for our overall enterprise risk management processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Getaround, Inc


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and company and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: Inogen Inc

ticker: INGN


text: Based on the risk appetite of the Company, the ERM department monitors enterprise-wide risk and control profiles. The ERM department provides monthly and quarterly risk reporting to management and the Board of Directors. The ERM department ensures accurate and timely risk assessments are prepared throughout the organization. The ERM department and compliance team also administer a documented regulatory change control process when new and revised regulations need to be implemented.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: To date, cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: FS Credit Real Estate Income Trust, Inc.


text: The Cybersecurity Program is integrated into our and our Manager's enterprise risk management framework that assesses, identifies and protects our and our Manager's enterprise information systems, data and business operations from various security threats and contains the following elements: • Information Security Risk Assessment - Conducting internal and external risk and control assessment, quality control and assurance testing. • Identity and Access Management - Managing enterprise identity and access control systems. • Security Architecture - Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support. • Security Engineering - Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses. • Security Operations - Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence. • Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cyber-attack simulations and tabletop exercises with senior management to detect control gaps. • Third-Party Assessments - Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. • Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • Conduct periodic risk assessments to identify cybersecurity risks in our IT systems • Monitor for external threats and manage incident response • Engage third-party security providers for penetration testing and program reviews based on National Institute of Standards and Technology ("NIST") standards • Perform internal audit reviews of IT-related controls • Assess cybersecurity risks of third-party vendors • Train employees regularly, including phishing simulations The cyber security program is continually adapting to the evolving threat landscape and technology developments.


text: Partnerships and Collaboration We believe in the strength of collaboration in combating cyber threats. We actively engage with cybersecurity communities, industry groups, and regulatory bodies to stay ahead of evolving cyber risks. By sharing knowledge and best practices, we enhance our defenses and contribute to the broader effort of securing the digital ecosystem. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: Paysign, Inc.

ticker: PAYS


text: We respond to cybersecurity events in accordance with our Cyber Security Incident Response Plan (CSIRP), which follows the guidance of the National Institute of Standards and Technology Cybersecurity Framework and provides for assessment, mitigation, and if necessary, remediation of any effects of a system breach. We also conduct annual breach simulations with internal information technology teams to test each step of our CSIRP.

companyName: HCI Group, Inc.

ticker: HCI


text: Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include an incident response policy, encryption of certain data, network security controls, segregation of certain data and system monitoring. Our incident response policy provides the framework for the execution of cybersecurity incident response procedures and internal communications while adhering to applicable legal reporting and disclosure requirements.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Our cybersecurity risk management strategy relies on input from certain members of management, including our Senior Vice President of Engineering and Chief Information Security Officer ("CISO") (reporting to our Chief Executive Officer) in consultation with our General Counsel and Head of Global Affairs (reporting to our Chief Executive Officer), our Chief Privacy Officer (reporting to our General Counsel) and input from various leaders who participate in our Privacy and Security Council. This team helps us understand cybersecurity threats and risks, establish priorities, and determine the scope, elements, and implementation of a cybersecurity program. The team is also responsible for integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.

companyName: Grindr Inc.

ticker: GRND


text: At 5C's Executive Committee meetings the CTO provides an executive summary report disclosing needed changes to our cybersecurity program, incidents, and potential threats. The Advisor's CTO has over twenty years of specialized experience in managing cybersecurity and information security programs for financial services organizations.

companyName: 5C Lending Partners Corp.


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: Innovex International, Inc.

ticker: INVX


text: The Audit Committee of the Board of Directors is charged with oversight of cybersecurity matters and receives regular reports from the CISO and the CIO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In accordance with our cyber incident response plan, the Audit Committee is promptly informed by management of cybersecurity incidents with the potential to materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Chair of the Audit Committee regularly briefs the full Board on these matters. In addition, the Board also periodically receives cybersecurity updates directly from management.

companyName: COCA COLA CO

ticker: KO


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 13 years in various information security roles and has over 20 years of experience in the cybersecurity field.

companyName: First American Financial Corp

ticker: FAF


text: The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. CONSOL Energy's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, such as machine learning intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The frameworks used to guide the deployment of technical safeguards include: International Organization for Standardization (ISO) 27001, Service Organization Control 2 (SOC 2), Sarbanes Oxley (SOX), and National Institute of Standards and Technology (NIST). The Company has been ISO 27001 certified since 2015 and is externally audited and certified annually by a leading IT compliance attestation firm.

companyName: BADGER METER INC

ticker: BMI


text: As of the date of this report, and based on facts currently known, the risks from previously occurring cybersecurity threats have not materially affected, nor do we believe that they are reasonably likely to materially affect BlackLine, including its business strategy, results of operations or financial condition. Notwithstanding our investment in cybersecurity, however, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition.

companyName: BLACKLINE, INC.

ticker: BL


text: We have also established a cross-functional Corporate Incident Response Team (CIRT) led by our General Counsel and consisting of various leaders, including our Head of Global IT, that is responsible for coordinating our response to cybersecurity incidents that present significant risk to us. The board of directors will be notified if the CIRT has been activated and provided periodic updates concerning the incident.

companyName: KADANT INC

ticker: KAI


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors and Audit Committee has responsibility for the oversight of risk management, including risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: CapForce Inc.

ticker: OPGN


text: The Company maintains general cybersecurity policies and procedures to assess, identify, and manage cyber threats, and has designated personnel to implement and maintain these policies and procedures, subject to oversight by our management and board of directors.

companyName: Vaxart, Inc.

ticker: VXRT


text: If deemed appropriate, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is training employees on our data privacy and cyber security procedures. For example, new hires receive mandatory privacy and information security training. In addition, current employees must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related awareness activities that we conduct throughout the year.

companyName: American Homes 4 Rent

ticker: AMH


text: As of the date of this Annual Report on Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our operations or financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors "Risk Factors Relating to Our Business-We depend on computer and telecommunications systems, and failures in our systems or cyber security threats, attacks or other disruptions could significantly disrupt our business operations." for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: The Audit Committee supports the Board by considering and reviewing the adequacy of the Company's internal controls with management and the Company's internal audit department, including the processes for identifying significant cybersecurity/data privacy risks or exposures, and elicits recommendations for the improvements to such procedures where desirable. The Audit Committee periodically reviews the Company's data security and privacy policies, procedures and risks. Members of management are expected to report matters to the Audit Committee or to the Board as a whole, as appropriate. Management's reporting on issues relating to risk management typically occurs through direct communication with directors or committee members as matters requiring attention arise.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: Our information security function, which includes our Executive Director of Information Technology ("IT") and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example conducting audits, evaluating threats, and performing vulnerability assessments.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: In 2019, APEI established the Information Security Steering Committee, or the Steering Committee, consisting of the Chief Executive Officer, Chief Financial Officer, Chief Information Officer, Chief Information Security Officer, General Counsel, and other members of the legal team, to establish and provide oversight over our cybersecurity program. The Steering Committee meets quarterly and is briefed, among other things, on our cybersecurity program, how we are mitigating risks, any notable events that occurred, and phishing campaign results. In addition, the Steering Committee reviews the program for the proper funding and staffing of the information technology security department as well as alignment of the program with our strategic objectives. The Steering Committee reviews and ratifies security policies and helps ensures the proper controls are in place and being followed. The Steering Committee is a critical element to review the cybersecurity program against applicable federal and state regulations and its progress for planned improvements.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is employee training on our data privacy and cyber security procedures. For example, all new hires receive mandatory privacy and information security training. In addition, current employees must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing that we conduct throughout the year.


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors of the Bank and Company annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors of the Bank and Company monthly through supplementary reports on issues related to Cybersecurity readiness.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: Management is responsible for developing cybersecurity programs. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: STRYVE FOODS, INC.


text: Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has over 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over eight years of experience leading our incident response management team.

companyName: LANDS' END, INC.

ticker: LE


text: As is the case for similar companies of our size and industry, we may be the target of cyber attacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. We have certain processes to systematically evaluate, identify, address, and manage cybersecurity risks, which are built into our overall risk management program and are designed to help safeguard our information assets and operational integrity from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, and continuity exercises on our systems. We also routinely review our policies and procedures to identify risks and refine our practices. By prioritizing cyber risk comprehension and management, we aim to enhance business resiliency, protect information from unauthorized access or attacks, and secure our digital footprint.

companyName: Sage Therapeutics, Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, third-party cybersecurity software providers. Additionally, we use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, including the performance of audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to interruptions to our operations such as our clinical trials; regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" risk factor.

companyName: Tracon Pharmaceuticals, Inc.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. See Part I, Item 1A, "Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, including the risk factor titled, If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as to our LungTraX Platform services or our clinical trials, claims that we breached our data protection obligations, harm to our reputation, business operations, and financial condition, as well as a loss of customers or sales.

companyName: Pulmonx Corp

ticker: LUNG


text: e.conduct regular phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct monthly cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

companyName: EXAGEN INC.

ticker: XGN


text: We plan to design our risk management program to also assesses third party risks, and we plan to perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we plan to perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Bimergen Energy Corp

ticker: BESS


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: ADIAL PHARMACEUTICALS, INC.

ticker: ADIL


text: Our Chief Information Officer ("CIO") together with our Senior Director of IT Infrastructure, Security and Compliance and other members of the Information and Business Technology ("IBT") Security team, are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our Security Incident Response Policy ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.

companyName: Twist Bioscience Corp

ticker: TWST


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the sections titled: "Risk Factors—Risks Related to our Business and Operations—If our telecommunications or information technology systems, or those used by our collaborators, CROs, CMOs, clinical sites, third-party logistics providers, distributors, or other contractors, consultants, or third party service providers upon which we rely, are or were compromised, become unavailable, or suffer security breaches, loss, or leakage of data or other disruptions, we could suffer adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences." and "Risk Factors—Risks Related to Government Regulations—We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial condition."

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of these plans, while also providing necessary training tools and guidance for company personnel. All of these items are incorporated into our overall risk management program.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes, which includes employee training on awareness and identifying cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy, and compliance activities are identified and addressed through our risk control process and through our monthly security meetings where we address the threat landscape, including risks related to our third-party service providers. We use an external cybersecurity firm and cybersecurity experts to provide various services to supplement our internal personnel and expertise.

companyName: T1 Energy Inc.

ticker: TE


text: We manage cybersecurity and data protection through a continuously evolving framework, as described in further detail below. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: VEEA INC.

ticker: VEEA


text: The Company's approach to risk management is designed to identify, assess, prioritize, and manage significant risk exposures that could affect the Company's ability to execute its corporate strategy and fulfill its business objectives. The Company manages enterprise risk through its Risk Management Committee ("RMC") chaired by the Company's Vice President of Compliance, Risk and Audit with direct oversight from the Company's General Counsel. The RMC, which is made up of senior leadership across a variety of business functions, defines the Company's enterprise risk framework based upon analysis of industry and peer benchmarking as well as company-specific data analysis.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: NNN's information systems process and store critical and sensitive NNN data. Management and the Board of Directors are committed to protecting NNN systems and data through layered perimeter, interrogation and access controls, as well as following a constant process of researching, assessing, patching and remediating. Processes to assess, identify, isolate, remediate and manage cybersecurity risks have been integrated into NNN's overall risk management system. Below are examples of actions NNN takes to protect NNN's information systems and data from cybersecurity risk: • Align systems and processes with best practices, including the National Institute of Standards and Technology Cybersecurity Framework, for securing NNN information systems and data; • Perform continuous systems monitoring and tactical measures for impending viruses, malware, tampering, exploits and other cyber threats; • Deploy systems tools to detect, prevent and neutralize cyber threats; • Engage independent third-party consultants to assist in evaluating cybersecurity risks and response profile and plans; • Identify, oversee and evaluate the risks associated with third-party service providers and consultants; • Continuously educate and provide procedural training to all associates and the Board of Directors regarding cybersecurity awareness and risks such as enterprise security, malware, data protection best practices, anti-phishing exercises and updates with respect to other implemented information security measures; • Periodically measure the effectiveness of associate training; • Cybersecurity risk management is periodically reviewed with NNN's Enterprise Risk Management Team; • Perform ongoing internal and external penetration testing and vulnerability assessments with a high priority for timely remediation; and • Establish reporting deadlines and hierarchies so that data regarding an incident or possible incident is communicated in a timely manner to NNN's management, to the Audit Committee of the Board of Directors, and if, appropriate or required by law, to the Commission.

companyName: NNN REIT, INC.

ticker: NNN


text: The oversight of cybersecurity risk at Brag House is currently managed by our senior executive team, including our Chief Executive Officer and Chief Operating Officer, who work closely with our technology partners to monitor, assess, and manage our exposure to cybersecurity threats. While we do not currently maintain an internal Chief Information Security Officer or formal risk committee at the board level, cybersecurity is included as part of our broader operational and strategic risk review process.

companyName: Brag House Holdings, Inc.

ticker: TBH


text: Our audit committee reports to our board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our management team on our cyber risk management program.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: In terms of governance, the Company employs an IT director, with over 20 years of relevant experience, who supervises our other IT employees and is also responsible for our outside technology services. Our IT director reports directly to our President and reviews cybersecurity assessments with our President on at least a monthly basis. Our President is responsible for escalating any cybersecurity matters as appropriate, in consultation with our General Counsel. Our Board of Directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from, and engages in regular dialogue with, Company management.

companyName: Omega Flex, Inc.

ticker: OFLX


text: While prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.

companyName: OceanTech Acquisitions I Corp.


text: Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee (the "InfoSec Committee"). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company's acting Chief Information Security Officer (CISO), Chief Legal Officer, VP of People, Senior Director of R&D & Engineering, VP of Global Marketing, Medical Affairs and our Senior Corporate Counsel. The InfoSec Committee meets on a monthly basis to provide oversight of the Company's information security management system ("ISMS"), review the performance and effectiveness of the ISMS, and review and discuss the direction of the Company's cybersecurity program, among other responsibilities. The committee also performs an annual audit to ensure Allurion's ISMS is effectively implemented and maintained. Our acting CISO, who is also our VP of Software Engineering, is responsible for the day-to-day oversight of the assessment and management of our information security program and cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: We have a comprehensive incident response plan to address cybersecurity incidents. Our incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting our information technology. To date, we believe that our cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: All DFARS requirements are flowed down to our sub-contractors, who are required to self-report their compliance to the U.S. Government. In addition to the processes and systems that we use to identify and mitigate risks, we utilize third party services to conduct valuations of our security controls, including penetration testing and independent audits. Despite our efforts to uphold the highest cybersecurity standards, we may still experience a cybersecurity incident that has a material effect on business strategy, results of operation or financial condition. It is also possible that additional regulations could affect our supply chain and increase costs. Prior cyberattacks directed at us have not had a material impact on our financial results nor restricted us from being awarded contracts from other defense companies or directly from the United States Department of Defense. However, we can provide no assurance that the occurrence of any future event would not adversely affect our internal operations, our reputation and competitive advantage, and our future financial results.

companyName: ESPEY MFG & ELECTRONICS CORP

ticker: ESP


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems, and those of our vendors, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. Cybersecurity incidents may also cause disruption to mining operations; critical financial or reporting systems impairment; breach or integrity loss of Newmont proprietary or confidential data; or external reputational damage.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: The Company conducts annual cyber-risk mitigation exercises including awareness outreach, annual IT Security Awareness training, periodic phishing simulations, and a variety of ongoing vulnerability scans. Over the past two years, the Company has implemented multiple new security tools designed to provide visibility and controls allowing the cybersecurity team to safeguard data against theft or loss.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Third-party risk management is an important focus of the Cooper Standard cybersecurity program. Cybersecurity is evaluated and considered throughout the lifecycle (onboarding, ongoing operations, offboarding) of third-party relationships as we conduct business with them. We review the security posture of each third-party prior to initiation of the relationship, and periodically throughout the relationship. We evaluate several aspects of information security, utilizing guidance from globally recognized frameworks (e.g., ISO/IEC 27001:2022). In addition to these point-in-time reviews, we continuously monitor the security posture of critical third parties through a third-party service. Critical service providers are also required to submit independently certified assurance of their security controls based on internationally recognized standards (e.g., ISEA 3402, SOC 1, SOC 2, etc.). Finally, upon relationship termination, we ensure each third party is properly offboarded, addressing critical cybersecurity concerns such as eliminating access and obtaining and/or deleting Company data.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: The Committee is the primary oversight body to monitor the Company's cybersecurity and related information technology risks and receives periodic updates from Company management (including, the Chief Information Officer and the CISO) on the Company's policies, processes, procedures, and any significant developments related to the identification, mitigation, and remediation of cybersecurity risks. The Chair or Vice-Chair of the Committee meet as necessary with the Chief Information Officer and the CISO to engage in a more detailed review of the Company's cybersecurity and information security activities. The Committee charter also requires that the Committee ensure that Company management provides an annual cyber and information security update to the Board of Directors. Current Committee members are: Zsolt Harsanyi, Ph. D., Sujata Dayal and Kathryn C. Zoon, Ph. D., all of whom are independent directors.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: The members of the Incident Response Team are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the Incident Response Plan processes described above.

companyName: DOC DR Holdco, LLC


text: As noted elsewhere in this annual report, we are materially reliant on a variety of third-party service providers to operate our business, which exposes us to the risk of cyber incidents impacting those providers' systems. We have a vendor risk management program that assesses, manages and oversees risks associated with third-party service providers who have access to our data and systems. We maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our engineering security team, led by our Chief Information Security Officer, or CISO, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to continually improve.

companyName: Snap Inc

ticker: SNAP


text: Our cybersecurity risk management program includes: • a security incident response plan that includes procedures for responding to cybersecurity incidents; • risk assessment processes designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • our Information Security team, principally responsible for identifying and mitigating cybersecurity risks, and managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes; • implementation of new hire and annual data privacy and cybersecurity training of employees, including senior management, and cybersecurity governance training for our Board of Directors; • a cybersecurity insurance policy to cover certain types of costs and losses from cybersecurity incidents; and • a third-party risk management process, including risk assessment and risk rating, for certain service providers, suppliers, and vendors.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section of our risk factors titled, "Risks Related to the Use of Technology."

companyName: Sprout Social, Inc.

ticker: SPT


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy and Framework approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information. Any findings identified are remediated following a risk-based approach. In addition to the cybersecurity controls managed and monitored within the organization, Northern Trust uses external third-party security teams on a regular basis to assess effectiveness of our cybersecurity program and controls. These teams perform program maturity assessments, penetration tests, security assessments, and reviews of Northern Trust's vulnerability to cyber-attacks. Northern Trust also operates a global security operations center for threat identification and response. This center aggregates security threat information from systems and platforms across the business and alerts the organization in accordance with its documented Cybersecurity Incident Response Plan.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Training and preparation are essential to the overall success of the CIMT to help ensure team members develop and maintain the operational, technical, and managerial skillsets necessary to support the effective function of the CIMT. Our CIMT members undergo training and preparation for cybersecurity incidents like participating in regular cybersecurity incident response tabletop exercises and reviewing lessons learned. Our general cybersecurity team receives extensive on-the-job training with respect to cybersecurity operations, maintenance, analysis, detection, investigation, mitigation, and protection. In addition, company-wide cybersecurity and insider threat training is mandated for our employees.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. The Company designs and assesses the program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that the Company uses the NIST CSF as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that the Company meets any technical standards, specifications, or requirements.

companyName: Solo Brands, Inc.

ticker: SBDS


text: The Board of Directors actively collaborates with management to supervise cybersecurity risks. The Chief Technology Officer ("CTO"), with over 10 years' experience in cybersecurity, leads the Company's overall cybersecurity function and monitors cybersecurity risks. The CTO works with internal personnel and third-party consultants to design and implement the controls on the prevention, detection, mitigation, and remediation of cybersecurity risks. The CTO maintains regular communication with the Board on matters related to cybersecurity and provides updates to management on a quarterly basis. In the event of a cybersecurity incident, the Board is to be promptly notified.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: The CTO, in coordination with the SLT, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The CTO and the SLT, through its information technology partner receives regular reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations. On an annual basis, the Audit Committee and the Board discuss the Company's approach to cybersecurity risk management with the members of the SLT, which includes the Company's CTO, GC, and Chief Financial Officer ("CFO").

companyName: Longeveron Inc.

ticker: LGVN


text: The ITAC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and our Chief Information Officer provide quarterly reports to the ITAC and ERM regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The ITAC reviews and approves our information security and technology budgets and strategies annually. Additionally, the ERM reviews our cyber security risk profile on a quarterly basis. The ITAC and ERM provide a report of their activities to the board of directors regularly.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: As of the reporting date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: American National Group Inc.

ticker: ANG-PD


text: Our cybersecurity risk management process includes: • Continuous enterprise-wide risk monitoring to assess and respond to emerging cyber threats. Our enterprise risk management assesses the characteristics and circumstances of the evolving business environment and seeks to identify both the potential impacts to our company of a particular risk and the speed with which the risk may manifest; • The deployment of technical security controls, including encryption, endpoint detection and response, and network security protections across our enterprise; • Enterprise-wide employee security awareness programs, including social engineering and phishing simulations and mandatory training; • Collaboration with external cybersecurity experts for penetration testing, vulnerability management, and incident response support; and • Security evaluations for vendors and other third-party service providers to help mitigate supply chain risks. These evaluations include reviewing our service provider and vendor management programs and the related agreements to require prompt notification of cyber incidents, outages and software vulnerabilities to facilitate timely assessment and disclosure of third-party cyber risks. Generally, we require our third-party providers to abide by confidentiality and security processes, particularly for third-party data-processing activities. Our evaluations also include inquiries about the vendor's or service provider's cybersecurity history, including any breaches or other incidents. Our third-party security evaluations are limited by their disclosures; therefore, a risk-based approach is used in making vendor and contractual decisions based on those disclosures and the totality of the circumstances, such as whether the third party will have access to personal information or our network. Through these measures, Urban One is committed to maintaining a strong cybersecurity posture and protecting against potential security threats.

companyName: URBAN ONE, INC.

ticker: UONE


text: We depend on third-party service providers to support our business and operational activities and to help us achieve our strategic goals. However, these third parties can introduce various risks to us and our customers. To mitigate these risks, we have established a Third Party Risk Management framework. This framework equips us with the necessary tools and practices for effective oversight of third-party service providers, ensuring compliance with legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: In the event of a potential cybersecurity incident, the third-party security operations center is authorized to take preemptive action to address the incident and must promptly notify a member of the ISC. The ISC coordinates the response to and communication of an incident in accordance with our Incident Response Plan ("IRP") and applicable law. The IRP is designed to provide guidance for effective, efficient, and orderly response to a variety of cybersecurity incidents. The ISC is responsible for communication escalation as necessary up to and including to the Board of Directors. The IRP is periodically exercised through tabletop exercises.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See the Risk Factor titled " We are subject to cyber-security risks, including those related to customer, employee, vendor or other company data and including in connection with integration of acquired businesses and operations " for a discussion of risk associated with cybersecurity.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a Cybersecurity Incident Response Policy; various other policies, plans, and frameworks in regards to (without limitations) access, acceptable use, password security and software system development; physical and administrative access and network security controls; data segregation; encryption of certain data; leveraging of certain SOC II-certified vendors; management, tracking and disposal of certain assets; systems monitoring; participating in information sharing and analysis centers to share and receive threat intelligence specifically related to biopharma and healthcare companies; and maintaining cyber insurance.

companyName: ACELYRIN, Inc.


text: Board of Director Oversight Our Audit & Risk Committee provides oversight of cybersecurity risk in connection with BKV's comprehensive cybersecurity strategy and receives regular quarterly updates on our ongoing assessment of cybersecurity risks, threats, and data security programs to prevent and detect breaches and attacks against BKV. The CIO and other experts, as necessary, provide the Audit & Risks Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers The Audit & Risk Committee meets quarterly to discuss areas that are potentially high risk to the Company.

companyName: BKV Corp

ticker: BKV


text: Given the complex and evolving nature of cybersecurity threats, we engage third-party advisors and consultants to assist us in developing and maintaining effective cybersecurity risk management processes. Partnering with these third parties allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, we work with third parties to regularly conduct simulated attack exercises to identify additional needs for training and overall program refinement.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Our Audit Committee oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Internal Audit function performs periodic audits of our cyber security program and reports results to the Audit Committee. On a periodic basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company's Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company's Executive Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company's ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Our CISO has served in various roles in information technology and information security for more than 30 years, including 20 years in Financial Services, along with serving as the Deputy Head of Global Information Security at ACI prior to being designated as CISO and has been with ACI since 2008. Our CCO has served in various risk and compliance roles in both global and regulated entities within financial services technology organizations, along with serving as the Head of Enterprise Risk at ACI prior to being designated as CCO and has been with ACI since 2022. The CCO's expertise focuses on designing, maturing, and embedding risk and compliance frameworks; credentials also include a Juris Doctor, a Masters of Business Administration with a focus in Finance and emphasis in consulting, and a Bachelors of Science in Business Administration.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We also engage third-party service providers to assist with managing various other aspects of our business. We have implemented processes designed to both assess and maintain oversight of third-party service providers with regards to cybersecurity risks. These service providers are subject to due diligence reviews of their information security programs during our vendor evaluation process.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: The mission of our information security program is to design, implement, and maintain a comprehensive information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. Our information security program is comprised of internal and external security and technology professionals who work collaboratively to identify, assess, manage, and mitigate cybersecurity risks and threats across our company, our subsidiaries, and third-party contractors.

companyName: RiskOn International, Inc.


text: We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Yext, Inc.

ticker: YEXT


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to BXPE.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: Our processes also consider risks associated with our use of third-party service providers and business partners, including those in our supply chain or who have access to our customer and employee data or our information systems. Third-party service provider and business partners risks are included within our cybersecurity risk management program, as well as the risk identification and assessment processes, both of which are discussed above. In addition, cybersecurity and privacy considerations affect the selection and oversight of our third-party service providers and business partners, as well as third-party specific integration plans. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in a specified manner, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Our processes for assessing, identifying, and managing material risks from cybersecurity are included in our Enterprise Risk Management ("ERM") program. Oversight of the Company's ERM program resides with the Audit Committee and our Board of Directors. The Audit Committee regularly reviews the results from the Company's ERM program with management. The Board of Directors receives updates from the EVP – Global Business & Information Services regarding cybersecurity framework developments and information that may impact the Company's cybersecurity posture.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: The Company conducts detailed due diligence (as described below), contract reviews and ongoing monitoring of high-risk third-party service providers. Third-party service providers hosting an application or providing a service that processes, analyzes, transmits, stores, or reports the Company's sensitive information must complete a control questionnaire. Vendors are subject to rigorous review of the vendor's internal control policies, procedures, data security and contingency capabilities. Ongoing monitoring is also performed annually on selected service providers. The program requires service providers on the ongoing monitoring list to provide the Company with a third-party security penetration assessment, and other artifacts based on the type of information processed, transmitted, or stored, annually.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Mr. Fletcher received a BS in Operations Research and Industrial Engineering from Cornell University.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: We consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. We have implemented a comprehensive cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. We prioritize data protection through data classification and access management designed to permit access only by authorized personnel. Our cybersecurity incident response plan, integrated into the enterprise risk management framework, outlines a structured process for handling information security incidents involving assets or data. It guides our computer security incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Controls and related activities are designed taking into consideration recognized third party cybersecurity frameworks.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: The Audit Committee of the Board of Directors has the primary responsibility of assisting our Board in the oversight of policies and processes pertaining to the ERM program and specifically considers risks and controls relating to, among other things, data and cybersecurity. Risks associated with cybersecurity threats are a top priority for ongoing oversight by the ERM team and the Enterprise Risk Committee. Our Chief Risk Officer oversees the activities of the Enterprise Risk Committee and, together with the Chief Information Security Officer (CISO), briefs the Audit Committee and the Board of Directors on information security risk matters as a part of regular ERM reports, with a deep dive focused on information security at least annually (or more frequently if appropriate).

companyName: H&R BLOCK INC

ticker: HRB


text: Processes for Identifying, Assessing and Managing Material Risks from Cybersecurity Threats PPL's Chief Security Officer (CSO) is responsible for establishing PPL's cyber-risk management strategy for PPL and the other Registrants and reports directly to PPL's Chief Executive Officer. The CSO has over 25 years of experience leading technology and security organizations, has a degree in computer science, and holds professional certifications in information security, IT auditing, and privacy. He is also a member of nationally and internationally recognized industry and security organizations, including the Information Systems Audit and Control Association, International Association of Privacy Professionals, and the Domestic Security Alliance Council. PPL's VP – Cybersecurity is responsible for implementing and executing the cyber-risk management strategy. The VP – Cybersecurity is a seasoned cybersecurity professional with a wealth of experience safeguarding digital assets across multiple industries. He maintains a globally recognized cyber certification and has held multiple certifications in the areas of cyber risk and information control, and actively contributes to industry advancement as a member of national and international industry groups. The teams managed by the CSO and VP – Cybersecurity are comprised of seasoned experts in cyber and IT security and possess appropriate experience to safeguard the company's data, networks and systems, mitigate cyber risks and help prevent and combat cyber threats.

companyName: PPL ELECTRIC UTILITIES CORP


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our incident response plan. A representative of our third-party information technology provider is a member of the incident response team. Our third-party information technology provider takes the lead on assisting us with the steps and procedures to contain the incident. If our third-party information technology provider is unable to contain the incident, we expect to work with our CTO/CISO and cybersecurity insurer to engage an appropriate vendor for containment.

companyName: LXP Industrial Trust

ticker: LXP


text: Although risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: Absci Corp

ticker: ABSI


text: To combat the ever-present cyber risks, the Company maintains a comprehensive Information Security Program ("ISP"), which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to protect, detect, respond, and limit unauthorized or harmful actions across our information technology environment. Standards over information security are Board-approved and various types of control testing is conducted throughout the year, by internal and external parties. Recommendations are implemented and reported to various committees. These security and privacy policies and procedures, for the protection of personal and confidential information, are in effect across all businesses and geographic locations. Board-approved policies are in place to effectively mitigate risks linked to third-party service providers, encompassing factors such as availability, confidentiality, and governance and compliance.

companyName: Merchants Bancorp

ticker: MBIN


text: We engage with a range of third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of our cybersecurity program. Services provided by these third parties include 24/7 security logging, network and endpoint monitoring, vulnerability scanning, penetration testing, security incident response tabletop exercises and security and compliance posture assessments. Vendor security monitoring is an important component of our cybersecurity program to ensure our vendors are securing and protecting our critical infrastructure, data, and information, integrated with our contract management process, including security addenda and vendor security risk assessments for new contracts and annual vendor security risk assessments for critical vendors.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Our approach to mitigating information technology and cybersecurity risk comprises a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of our critical IT Systems and information related to our business. We seek to design and execute our cybersecurity risk management program based on a globally recognized controls framework. Additionally, we assess our cybersecurity maturity against that framework. However, the foregoing does not imply that we meet any particular technical standards, specifications or requirements, only that we use an established framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Custom Truck One Source, Inc.

ticker: CTOS


text: We are a start-up company with limited operations, yet we recognize that we are subject to various cybersecurity risks that could adversely affect our business. Cyberattacks on companies around the world continue to increase, which cause operational failures, compromised sensitive corporate or customer data, and/or result in significant financial damages. These attacks occur over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as a cybersecurity incident response plan.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Our Board, directly or through its committees, is responsible for the oversight of the Company's overall enterprise risk management program that includes cybersecurity risks. Our Audit Committee regularly reviews and evaluates cybersecurity risks and the procedures and policies implemented by management to identify, manage, and mitigate such risks.

companyName: ICF International, Inc.

ticker: ICFI


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.

companyName: QWEST CORP

ticker: CTBB


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Our primary custodian is currently BitGo Trust Company, Inc. a South Dakota corporation ("BitGo") and is regulated by the state of South Dakota. On May 1, 2025, we entered into a Custodial Services Agreement with BitGo (the "BitGo Agreement") to hold our digital currency. The term of the BitGo Agreement is for one year with successive one-year renewals unless prior notice of non-renewal is given by either party. The Company pays BitGo a monthly digital asset storage fee based upon the market value of the assets in storage, plus $500. The BitGo Agreement is terminable by either the Company or BitGo on thirty days' notice as a result of a breach of the Agreement and may be suspended by BitGo if the Company violates the intended use of the account or due to a change in the applicable law, litigation or bankruptcy.

companyName: UPEXI, INC.

ticker: UPXI


text: Risk Management Strategy We have developed our cybersecurity risk management program, including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework's (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover. This does not, however, imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: As one of the elements of the Company's overall risk management program, the Company's cybersecurity program is focused on the following key areas: • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to among other things: Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures; monitor Company networks, servers and endpoints to identify vulnerabilities;

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks, including as a result of previously identified cybersecurity incidents that have, or are reasonably likely to have, materially affected us, including our business strategy, results of operations, or financial condition. We have periodically encountered threats and security breaches affecting our data and systems, including malware and cyberattacks. We recognize that cybersecurity risks are constantly evolving, and while we implement robust security measures, the potential for future incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: GENESIS ENERGY LP

ticker: GEL


text: The Board of Directors is responsible for overseeing the development, approval, implementation and maintenance of the ITSM, including overseeing the program's execution in accordance with the overall strategic goals of the Bank. The Board conducts oversight, in part, through the use of committees. The Risk Management Committee ("RMC") of the Board of Directors is charged with monitoring and reviewing risk assessments, assurance, testing, and training as well as overseeing the correction of identified deficiencies as they relate to the ITSM. The Company's Information Security team, with input from the Information Technology and Risk departments, is responsible for incident management, disaster recovery, business continuity and cybersecurity programs and policies. The Bank's Incident Response Manual and Cyber Incident Policy outline how potential cybersecurity threats or incidents are communicated to the RMC. The RMC is responsible for determining if cybersecurity incidents or threats should be escalated to the Board of Directors. The information security team and the RMC work together to mitigate cybersecurity threats or incidents.

companyName: Provident Bancorp, Inc. /MD/


text: During 2024, the Company engaged a third-party technology firm to conduct an annual cyber risk assessment. The assessment resulted in certain recommended upgrades being made to the Company's network. In early 2025, the Company engaged an independent cyber security firm to conduct a more comprehensive assessment of the Company's information technology system. The Company is currently awaiting the findings from that assessment.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and Reviewing and evaluating new developments in the cyber threat landscape.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: We have also established a committee of our executive leadership team to consider cybersecurity risks and to consider mitigation strategies in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO, Audit Committee and our Board.

companyName: SMITH A O CORP

ticker: AOS


text: Dow contracts with external firms to assess Dow's cybersecurity controls relative to its peers using the NIST CSF. Dow also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: DOW INC.

ticker: DOW


text: Our cybersecurity team monitors the cyber risk climate on an ongoing basis and performs cyber risk assessments at both tactical and strategic levels that are integrated into our overall risk management processes. These risk assessments may review various issues such as Payment Card Industry Data Security Standard compliance and cyber vulnerability on an enterprise and application level.

companyName: Aramark

ticker: ARMK


text: We observe Cybersecurity Awareness month with interactive weekly training, workshops, and additional resources on strong cybersecurity practices. In addition to Cybersecurity Awareness month, additional cybersecurity training and awareness initiatives occur throughout the calendar year, including annual security compliance training; a monthly Cybersecurity Awareness Series composed of articles and training highlighting current cybersecurity concerns; company-wide communication as necessary to alert team members of potential threats; and weekly security-related videos with opportunities to win prizes through participation. We track participation in training events and boast high participation rates, with continuous reflection on strategies for driving participation yet higher.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Management continuously monitors the effectiveness of our cybersecurity defenses. We invest in regular and ongoing cybersecurity training for our IT department and company overall. Our Senior Vice President Business Technology has certain IT industry certifications and brings 30 years of IT background spanning all facets of technology, including applications, infrastructure and cybersecurity. Our Director of IT Security has over 20 years of experience in cybersecurity, including duties as an Information Security Officer in the United States Air Force.

companyName: Green Plains Inc.

ticker: GPRE


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. In the future, we intend to require each significant third-party service provider to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: Management and Strategy maintain a cybersecurity program aligned with NIST CSF standards designed to identify critical assets and vulnerabilities, protect them with appropriate safeguards, promptly detect cybersecurity events, respond effectively to mitigate their impact and recover from incidents to restore services. Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: We use third-party managed service providers to assist us in identifying, assessing, mitigating and managing potential risks from cybersecurity threats. In addition, we engage other advisors from time to time to help identify, assess, mitigate and manage new or developing risks in a changing threat landscape. Such ongoing services and periodic services include professional services from providers such as legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, and forensic investigators (as needed).

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Conduct after-action evaluation to identify what went well, what did not go well and improve FRI's systems after an issue FRI employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis. FRI maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact FRI's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within FRI's NIST framework, and risk identification and mitigation are supported by FRI's Global Corporate Continuity Program. FRI also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: Franklin Templeton Holdings Trust

ticker: FGDL


text: We have also established a Disclosure Committee, which regularly reviews relevant information related to potential public disclosure of critical business risks and material events.

companyName: TELA Bio, Inc.

ticker: TELA


text: Company's Chairman of the Board of Directors is tasked with reporting on cybersecurity measures and issues to the entire board of directors. In the event of a cybersecurity incident, Company policy is for the Company Chairman of the Board of Directors to report the cybersecurity incident to the Company's Board of Directors and take remedial actions to mitigate and remediate cybersecurity incidents.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our dedicated Information Security Team is responsible for identifying, assessing, detecting, and responding to any threats and vulnerabilities. The team routinely collects and processes information from a variety of sources, including from media reporting, commercial threat intelligence providers (FSARC, FS-ISAC), the Federal Bureau of Investigation and other government and law enforcement agencies. The team provides global mitigation of known cybersecurity threats to help ensure that our data and systems are protected.

companyName: Perella Weinberg Partners

ticker: PWP