text: Our Chief Information Security Officer is responsible for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, information governance risk and compliance, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Our program is regularly evaluated by internal stakeholders and external parties with the results of those reviews reported to the executive leadership team and the Audit Committee, as appropriate. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future incidents. For more information on our cybersecurity related risks, see the Risk Factors in Item 1A. of this Annual Report.

companyName: Alight, Inc. / Delaware

ticker: ALIT

secItem: Item 1C


text: The Company takes a comprehensive, cross-functional approach to developing strategies for identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. The Company maintains a business continuity and disaster recovery plan as well as a cybersecurity insurance policy.

companyName: GoHealth, Inc.

ticker: GOCO


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board with the annual assessment by a third party on the Company's cybersecurity program.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: Ashland's information security program is led by the Company's Vice President of Cyber Security who is a Certified Information Systems Security Professional (CISSP) with more than 30 years of experience in information technology and 12 years of experience serving in a chief information security officer role or top executive leader in cyber. Our Vice President of Cyber Security is primarily responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy. The Vice President of Cyber Security also holds a master's in business administration and a Bachelor of Science degree in Computer Science and Engineering. In addition, other members of the Company's information security team also have significant experience in information security.

companyName: ASHLAND INC.

ticker: ASH


text: We continue to invest in our cybersecurity program to help ensure that we have the necessary resources to execute our business operations and that our workforce is prepared to work in an active cyber-threat environment. These resources also include external service providers with experience in third-party risk monitoring and cybersecurity threat intelligence, detection and response. Mandatory training is required on a quarterly basis for all CFC employees to promote leading practices in protecting information, data and operations in a continually changing environment.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Integration into Overall Risk Management System or Processes. Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools, and protocols (automated and human), internal and external independent auditing, management committee review, defined lines of communications, employee training, engagement of outside advisors and experts, assessment and utilization of both commercial and self-insurance opportunities, customer contract standardization where possible, legal review of vendor engagements and new products for regulatory compliance, regular operations reviews with the CEO, and Board (and Board Committee) oversight. Manhattan utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats. The CFO or their designee reports to the full Board at least quarterly on the status of our Cyber Program.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Our cybersecurity risk management program also addresses cybersecurity risks associated with our use of third-party service providers and vendors. We proactively manage these risks by reviewing current and prospective third-party service providers' compliance with our established, relevant privacy and data security standards. We also require our key vendors to complete security questionnaires, and we conduct audits and vulnerability scans of those vendors and their systems. Depending on the nature of the services provided and the sensitivity of the relevant data involved, our service provider and vendor management processes may involve different levels of assessment and impose additional obligations related to cybersecurity on the service provider or vendor.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: Our cybersecurity risk management strategy relies on input from management, including our Vice President, Technology & Information Security, who reports directly to our Chief Operating Officer, and has over ten years of experience in developing and implementing cybersecurity strategies for companies in the biopharmaceutical industry, as well as our Chief Financial Officer and General Counsel. We have also formed an Information Risk Assessment Committee, or IRAC, consisting of senior members of the finance, legal, operations and information technology functions, to oversee the management of information security as a whole, including integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees. The IRAC meets on a regular basis, generally quarterly, to discuss cybersecurity risk and to review our cybersecurity program.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: We assess, identify and manage risks from cybersecurity threats through our global cybersecurity program. The program is managed by a full-time Chief Information Security Officer ("CISO") whose organization manages our cybersecurity strategy, architecture, policies, standards and processes for the security of Haemonetics' enterprise network and information assets. The CISO reports to our Chief Information Officer ("CIO") and is supported by a dedicated security operations team. Our current CISO has over 20 years of information technology experience, including positions of increasing responsibility with respect to security architecture, software engineering, security operations and incident response.

companyName: HAEMONETICS CORP

ticker: HAE


text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The company conducts regular risk assessments on systems and applications to detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.

companyName: WK Kellogg Co


text: Internal training and awareness – We provide training to our employees to help identify, avoid, and mitigate the risk from cybersecurity threats. Our employees are required to complete mandatory cybersecurity awareness training upon hiring and also participate annually in required cybersecurity awareness training, unless on a leave of absence.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: We evaluate cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. We employ a Cybersecurity Engineer, reporting directly to our Chief Technology Officer, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized certifications. The cybersecurity team within BIO-key is responsible for assessing and managing risks and informing/gaining feedback from the cybersecurity steering committee.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information we collect and store for use in operating our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, suppliers, other business partners and employees; and (v) providing appropriate disclosure of cybersecurity risks and incidents when required. Our cybersecurity and data protection policies, processes and strategies are informed by regulatory and business requirements, our prior experience addressing cybersecurity attacks and incidents (including with our former affiliates) and industry practices, and are periodically adjusted based on the results of assessments conducted through our ERM practices, third-party audits and independent reviews, and other processes.

companyName: PHINIA INC.

ticker: PHIN


text: Our offices are physically secured with key card access controls for parking, first floor access, and elevator access. In addition, security guards monitor building reception areas and parking garages, and receptionists are located in our lobbies to greet visitors. The Company engages assessors, consultants, auditors, or other third parties in connection with its cybersecurity processes.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Management's role in assessing and managing material risks from cybersecurity threats is an important and multifaceted component of the Company's cybersecurity. Appropriate members of the Company's senior management, including the Chief Information Security Officer ("CISO"), Chief Risk Officer ("CRO") and Chief Information Officer ("CIO"), are responsible for assessing and managing cybersecurity risks, which involves an ongoing process of identifying, analyzing, evaluating, and addressing the Company's cybersecurity threats.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Management continuously monitors the effectiveness of our cybersecurity defenses. We invest in regular and ongoing cybersecurity training for our IT department and company overall. Our Senior Vice President Business Technology has IT industry certifications and brings over 30 years of IT background spanning all facets of technology, including applications, infrastructure and cybersecurity. Our Director of IT Security has over 20 years of experience in cybersecurity, including duties as an Information Security Officer in the United States Air Force.

companyName: Green Plains Inc.

ticker: GPRE


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Technology and Security team is responsible for the management, maintenance, monitoring and response of our critical internal digital assets. This team is led by our Senior Director of Global Information Technology and Security, who has 25 years of cyber and Enterprise IT management experience. This position monitors current cyber risk trends, engages with 3rd party cyber security experts, and meets with the Infrastructure and Security team regularly to stay apprised of internal cyber risks.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: While we have been subject to cyber incidents, the expenses (including penalties and legal settlements, of which there were none) related to such incidents were immaterial. The risks related thereto have not been and are not reasonably likely to be material to our business strategy, results of operations or financial condition. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A Risk Factors – "Risks Related to Cybersecurity and Information Technology," which is incorporated by reference herein.

companyName: MARZETTI CO

ticker: MZTI


text: Monitoring Cybersecurity Incidents The Company's management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: At Psychemedics, the Vice President of Information Technology also serves in a dual capacity as the Chief Information Security Officer (VPIT & CISO) overseeing our information security program. The VPIT & CISO's team is tasked with the development and implementation of cybersecurity strategy, policy, standards, architecture, and processes. Our cybersecurity program is aligned with industry standards and best practices, such as the CIS Critical Security Controls ("CIS 18") Implementation Group 1 ("IG1") guidelines. We maintain an incident response and recovery plan, including measures for responding to and recovering from cybersecurity incidents. To minimize the threat surface, we strategically limit the use of third-party service providers with access to personal, confidential, or proprietary information. Also, we evaluate these providers and take steps to help mitigate risks associated with their use and minimize the potential for supply chain attacks. Employing a risk-based approach, we are committed to continuously reassessing our cybersecurity posture and improving our defenses in response to evolving and emerging threats. While we have not experienced any known material incident in the past year, we acknowledge that we have limited resources dedicated to identifying and mitigating cybersecurity risks and that an information security plan is not infallible.

companyName: PSYCHEMEDICS CORP

ticker: PMDI


text: In accordance with our policies and procedures, we investigate any technological, computer, or network security event or incident within our networks or involving confidential and sensitive data maintained by Oncor, including events or incidents involving third-party vendors that interface with our networks or otherwise hold confidential and sensitive data maintained by Oncor. With respect to certain of our third-party vendors, we may also require such third-party vendors to notify us of any cybersecurity incidents and/or vulnerabilities that may impact our operations or involve confidential and sensitive data maintained by Oncor. Multiple security operations centers monitor our digital environment at all times for anomalies, threats, and indicators of compromise. We have a variety of tests performed by internal and external parties related to the integrity of our networks, cyber protections and policies and procedures. Third-party and internal security testing of our network, applications, perimeter, physical equipment and other areas of security are used to test cybersecurity readiness. When a cybersecurity threat either newly materializes or escalates, we elevate communication both internally and externally to ensure situational intelligence is both known and shared to help in defending against that threat.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Vice President of Privacy, Safety, and Security Engineering. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Alphabet Inc.

ticker: GOOGL


text: Our MSP assists us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools, including, but not limited to, endpoint protection tools, phishing protection and access controls. We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.

companyName: Vivani Medical, Inc.

ticker: VANI


text: The Company's Chief Information Officer has served in various roles in information technology and information security for over 27 years, including serving in technology leadership roles such as Chief Information Officer, Senior Director of Commercial Technologies, Senior Director of Corporate Systems, Senior Director of Business Intelligence and Analytics, and Quality Assurance leadership roles for large public companies. The Company's Chief Information Officer was also a Client Director for the Department of Army/Department of Defense for a large public research and advisory services firm and holds a B.A. in Economics from Miami University and an MBA in Information Technology from The University of Maryland.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: We utilize firewalls, anti-virus software, encryption on stored data and communication channels, secure web portals for remote access to our systems, password security, and two-factor authentication. We continuously update our software and security patches. We restrict inbound email attachments, certain websites, and cloud-based drives. We monitor and restrict information transfers to and from unauthorized IP addresses. We also have physical security safeguards for our locations and data centers. We back up our systems and data regularly.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: The Company has an integrated, cross-organizational risk management approach. As part of our overall risk management processes, we assess, identify and manage material risks from cybersecurity threats through our cybersecurity risk management program which leverages the National Institute of Standards and Technology (NIST) framework, organizing cybersecurity risks into five categories: identify, protect, detect, respond and recover. However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we leveraged the NIST framework as a guide in the creation of our cybersecurity risk management program. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our Chief Technology Officer and security team, led by the SVP of Information Technology and Security, (collectively, the "Cumulus Security Team") monitor cybersecurity incidents using a variety of security information and event management tools. Alerts from those tools are monitored 24/7 and addressed accordingly. The type of incident identified and severity level determine how issues are escalated and who is engaged for resolution. If a cybersecurity incident or aggregated series of incidents is deemed material, the incident is communicated to various members of the Company's leadership team and the Board of Directors. Disaster recovery plans are documented for key systems and would be followed in the event a security incident occurs.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example incident response plans, incident detection and response policies and procedures, vulnerability management policy, disaster recovery plans, and encryption of data.

companyName: Enovix Corp

ticker: ENVX


text: The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. The Company's CCO updates the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: Antares Strategic Credit Fund


text: Our cybersecurity risks are identified and addressed through a cross-functional approach that includes coordination through our Corporate Information Security Committee, which includes senior managers in our information security, information technology, operations, risk, compliance and privacy departments or functions. Key security, operations, risk, compliance and privacy stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to follow state and federal regulations to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board in a timely manner.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Risk Management and Strategy have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: CIRTRAN CORP

ticker: CIRX


text: Cybersecurity risk management is part of management's annual risk assessment program. In order to manage the risks associated with cybersecurity threats, the Company maintains a risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: The Company maintains a Security Committee, which is led by the CIO and is comprised of individuals from the Company's IT department – including dedicated security team members with various security certifications. The Security Committee regularly reviews information security program governance and key performance indicators. These reviews typically include the number of events, number of investigations, mean response time, and cyber trends. The Security Committee oversees the Company's security roadmap and ensures monitoring of information security policies and procedures covering areas such as back-up and retention, acceptable use, disaster recovery, incident management, and passwords.

companyName: Dorman Products, Inc.

ticker: DORM


text: The Partnership's Board of Directors has oversight of cybersecurity risks. The Board of Directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: The company's Internal Audit organization audits the Corporate Risk & Compliance division's oversight of cybersecurity risk management and also independently tests the effectiveness of the company's cybersecurity risk management and

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.

companyName: NN INC

ticker: NNBR


text: Our Vice President, Information Security, who reports to our Chief Information Officer, is responsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has 20 years of experience in IT roles, including 13 years in IT leadership roles and 5 years in cybersecurity program execution and oversight of information security.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: We have formed a cross-functional Cybersecurity Task Force that focuses on long-term cybersecurity strategy. The Cybersecurity Task Force is composed of members from the information security, engineering and legal teams and reports to our Chief Technology and Product Officer. The Cybersecurity Task Force meets periodically to discuss developments and best practices in cybersecurity incident response. In addition, the Cybersecurity Task Force reviews the business impact and severity of potential cybersecurity incidents, as reported by our automated systems, utilization of the bug bounty program, and public reports on the threat landscape.

companyName: TheRealReal, Inc.

ticker: REAL


text: Following the conclusion of an incident, the incident response team will generally assess the effectiveness of the cybersecurity program and IRP and make adjustments as appropriate.

companyName: Public Storage

ticker: PSA


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the CIO, the Chief Executive Officer and others. These individuals work with the Company's incident response team, pursuant to a documented incident response policy, to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: One of the key functions of our Board of Directors (the "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. While we do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition, such threats could occur nonetheless.

companyName: Dakota Gold Corp.

ticker: DC


text: The Company's cybersecurity process and its ability to assess, manage, and remediate cybersecurity risks further centers around good communication among management. Management stays informed on cybersecurity risks through open communication with the Risk Management team, including through various reports and weekly reporting by the Chief Risk Officer to the Senior Management Committee about cybersecurity matters, as necessary. In the event there is a material cybersecurity incident, the Company's policies and procedures set forth an action plan, which includes notification of the appropriate personnel and management within the Company, as well as regulators and impacted customers, as applicable.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Arcellx, Inc.

ticker: ACLX


text: We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program, as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business. Our cybersecurity practices are aligned with standard industry frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, International Organization for Standardization (ISO) 27001, Center for Internet Security Critical Security Controls and other industry standards.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of Information Technology ("IT") who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. We have a dedicated IT resource with expertise in cybersecurity and risk management who is dedicated to working with our internal IT team on cybersecurity risk management.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: The Company's board of directors, or the Board, recognizes the critical importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, mitigating and remediating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Our cybersecurity risk management program is supervised by our Director of Information Systems, who has over 20 years of relevant experience, and whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program.

companyName: ELUTIA INC.

ticker: ELUT


text: Recognizing the threat of security breaches and cyberattacks globally, we have developed a cybersecurity program, overseen by our Chief Information Security Officer (CISO) and Chief Information Officer (CIO), that is designed to protect patient trust, defend the Moderna brand, and reduce the risk and impact of cyber-attacks. Our cybersecurity program is informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify, and manage risks from cyber threats. In addition, we have implemented employee security and awareness training.

companyName: Moderna, Inc.

ticker: MRNA


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors.

companyName: MYOMO, INC.

ticker: MYO


text: The Company's Board of Directors oversees the processes for risk management, including cybersecurity risks, to help align risk exposure with strategic objectives. Senior manage ment periodically briefs the Board of Directors on our cybersecurity framework and assessments of the information security program, key and emerging threats and risks, the status of projects to strengthen our information security systems, and any cybersecurity incidents that could potentially have a material business impact. In the event of an incident, the Company would follow a detailed incident response plan, which outlines the steps to be followed, including notification of senior management and the Board of Directors, as appropriate.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: The Cybersecurity and Privacy team, which maintains our cybersecurity function, reports to our Chief Technology and Digital Officer, who reports directly to our Chief Executive Officer. The Cybersecurity and Privacy team is led by our Chief Information Security Officer ("CISO"), who is responsible for developing and implementing our cybersecurity program and reporting on cybersecurity matters. The CISO and Chief Technology and Digital Officer report to the Cybersecurity, Technology and Innovation Committee (the "Committee") at least three times per year. Our CISO has been a cybersecurity leader for 20 years, maintains appropriate security certifications, and has extensive experience in building and maintaining cybersecurity risk and compliance programs. The cybersecurity team includes members who also have various levels of cybersecurity experience and maintain relevant cybersecurity certifications. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security controls and technologies and ongoing scanning and testing of Company information systems by internal teams as well as third-party organizations to identify potential vulnerabilities. To maintain knowledge of the latest developments in cybersecurity, evolving threat landscape, and cyber defense techniques, our CISO regularly attends cybersecurity related conferences and events hosted by cybersecurity experts, subscribes to cybersecurity threat intelligence communications and newsletters, and meets with cybersecurity vendors.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: Lafayette Square maintains a cybersecurity program which includes processes for assessing, identifying, and managing material risks from cybersecurity threats in the form of unauthorized occurrences that could result in adverse effects on the confidentiality, integrity, or availability of the Company's information systems (any such occurrence, a "Cybersecurity Incident"). The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Lafayette Square USA, Inc.


text: Our cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity threats seeks to protect the confidentiality, security and availability of the information that we collect and store by focusing on identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Federal Home Loan Bank of Topeka


text: Ladder also maintains processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers based on the service provider's risk profile. Ladder does not generally maintain consumer data, and does not extensively leverage third parties to manage or process sensitive data. Most of the third parties that have access to sensitive information belonging to us or our borrowers, clients or other counterparties are lenders, law firms and other third parties that require such access in connection with Ladder's commercial lending activities. These third parties tend to be highly regulated and generally maintain mature cybersecurity programs and data security controls. When Ladder leverages third-party service providers that collect or maintain sensitive information, Ladder conducts initial diligence on such third parties and conducts ongoing monitoring that includes annual due diligence questionnaires and contractual data security protections. In addition to the policies and procedures discussed above, Ladder leverages industry standard third-party technology, tools and services to assist in monitoring, detecting and managing cyber threats, including managed security service monitoring, endpoint detection and response tools. Ladder also maintains other appropriate cybersecurity controls, including: • Annual penetration testing by rotating third-party vendors; • Vulnerability scans; • Company-wide cybersecurity training, including quarterly phishing exercises; • Tabletop exercises; • Vendor cybersecurity diligence; and • Cyber insurance.

companyName: Ladder Capital Corp

ticker: LADR


text: Threats and Incidents. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our company, including our business strategy, results of operations or financial condition. However, we and third-parties with which we have shared personal information have been subject to attempts to breach the security of networks, IT infrastructure, and controls through cyberattack, malware, computer viruses, social engineering attacks, ransomware attacks, and other means of unauthorized access. For example, in February 2023, we experienced a cyberbreach resulting from a global ransomware attack that impacted thousands of network servers around the world and which encrypted certain of our network servers. In this case, our internal IT department together with third-party cybersecurity incidence response teams that we keep on retainer were able to unencrypt and restore most of the affected servers and restore others from backups within a few days and with minimal disruption to our manufacturing operations, sales, order processing, distribution and other business operations, and without paying any ransom. We incurred costs relating to the cyberattack, including costs to unencrypt and restore our servers, scan our network to ensure there was no remaining malware or other problematic remnants of the attack and to enhance our cybersecurity defenses.

companyName: B&G Foods, Inc.

ticker: BGS


text: As part of its board-level risk oversight responsibilities, the Audit Committee provides oversight of the Company's privacy, data, cyber security, and information security risk exposures. Further, at a management level, the Company's cybersecurity risk management program is led by our CTO, who reports to the Company's CEO. Our CTO was appointed as the Company's senior vice president and chief technology officer in July 2017. Our CTO has expertise in cybersecurity risk management through his more than 20 years of experience in healthcare technology, including his service with us as well as his service as chief technology officer at other organizations prior to joining the Company in 2017. On a quarterly basis, the Company's CTO reports to the Audit Committee regarding the Company's cybersecurity program. The CTO also reports to the Audit Committee on a quarterly basis regarding remediation activities, if any, along with related security metrics, in connection with any areas where cybersecurity threats have been identified.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face potential cybersecurity threats that, if realized, would materially affect us. These threats include but are not limited to ransomware and malware attacks, and compromised business email and other social engineering threats. Our suppliers, customers, contractors and business partners also face similar cybersecurity risks, which could have an adverse impact on our business. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - While we are not aware of any data breach in the past, future cyberattacks, computer viruses or any failure to adequately maintain security and prevent unauthorized access to our information technology system or data could result in a disruption of our business operations and materially adversely affect our reputation, financial condition and operating results."

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: Cybersecurity Incidents We are not aware of any material cybersecurity events that are likely to have a material effect on our business strategy, results of operation or financial condition.

companyName: Jackson Financial Inc.

ticker: JXN


text: Our Cybersecurity and Digital Risk Management ("CDRM") organization, under the leadership of a Global Chief Information Security Officer ("Global CISO"), operates a cybersecurity program that is designed to help us assess, identify, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guides in supporting our ability to perform such functions.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Risks from Cybersecurity Threats As discussed above, in February 2023, we identified that we had become subject to a ransomware incident. Based on our investigation, we concluded ransomware actors encrypted certain of our systems by deploying malware. This incident required us to temporarily suspend operations at certain of our facilities and had a material impact during the three months ended March 31, 2023 on our ability to process orders, ship products and provide service to our VSD and PSD customers.

companyName: MKS INC

ticker: MKSI


text: The management-level responsibility for assessing and managing cybersecurity risk is led by our CISO and CTO. Prior to joining Chubb in 2015, our CISO was Director of the threat analytics platform for a major cybersecurity incident detection and response company. Prior to that, our CISO was an executive leader within the information security practice and a technical architect with two global accounting firms. Our CTO has extensive experience as a chief technology officer in digital-first environments and was previously the chief technology officer of a large global bank, responsible for the bank's core infrastructure, end-user technology, production support, group architecture, cloud technology, and software license management. Our CTO holds a master's degree in geographical information systems and a bachelor's degree in artificial intelligence and computer science. Chubb management also benefits from the advice provided by a Cyber Advisory Board of external experts. The members of the Cyber Advisory Board have extensive experience and deep expertise on cybersecurity matters, several having served in senior government positions with executive responsibility for identifying and mitigating cyber threats across the globe.

companyName: Chubb Ltd

ticker: CB


text: 3.In the event of a security incident, the service center's CIO and CISO are responsible for launching an Incident Response Team ("IRT") if necessary and notifying the executive team, who will contact the board of directors and the Audit Committee to validate the response;

companyName: Pennant Group, Inc.

ticker: PNTG


text: We are dedicated to managing cybersecurity, privacy, and data protection and security risks. We employ various tools, processes, technologies, and controls to identify and manage such risks.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Engagement of Third Parties in Connection with Risk Management The Company engages various third parties to evaluate the effectiveness and maturity of our Program. The Company engages an independent third party to audit the cybersecurity risk strategy and preparedness. The Company also maintains cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured. The Company also engages third parties to perform regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate threat actor attacks. Our relationships with third parties enable us to leverage their cybersecurity expertise and industry knowledge to assess our Program and make adjustments as needed.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K under the heading "Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to clients, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects," which should be read in conjunction with the information above.

companyName: Sharplink, Inc.

ticker: SBET


text: Governance and Responsibilities The Board recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management, or ERM. The Company seeks to mitigate cybersecurity risks through a cross-functional approach, including its Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by assessing, identifying, preventing, and managing risks from cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our ongoing monitoring and evaluation have not identified any cybersecurity risks that are expected to significantly affect our operational capabilities, financial condition, or business objectives in the foreseeable future.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization, treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into strategic business risks and incorporated into the ERM program.

companyName: Criteo S.A.

ticker: CRTO


text: the importance of cybersecurity to our business, we maintain a cybersecurity program that is based on a set of cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo periodic evaluations of our cybersecurity program through cybersecurity assessment and cybersecurity incident response tabletop exercises, conducted by our cybersecurity advisors.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Our CSPO, CISO and other dedicated cybersecurity risk management personnel are certified and experienced information systems security professionals and information security managers. Our CSPO has over 30 years of experience in information security having 16 years of experience leading information security programs and obtained the Certified Information Systems Security Professional certification from ISC2. Our CISO, who has over 34 years of experience in cyber operations, communications, crisis management and command and control, holds multiple graduate degrees, obtained the Certified Information Systems Security Professional certification from ISC2 and holds the Qualified Technical Expert certification from the Digital Director's Network.

companyName: CENTENE CORP

ticker: CNC


text: We also have a team of employees, including at the senior management level, who are dedicated to assisting the Board in fulfilling its oversight responsibility for cyber and information security. Valley's Chief Information Security Officer (CISO), who is responsible for developing and implementing our cyber and information security program, has over 24 years of experience leading cyber security oversight and holds a CRISC certification, and others on our information security team have cybersecurity experience or certifications. The CISO and Director of Cyber Risk Management each participate in all meetings of the Cyber Subcommittee.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. Overall, our company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of our cyber risk management strategy and the controls designed to protect our operations. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: We recognize the critical importance of maintaining the trust and confidence of stakeholders toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: These threats are then addressed by implementing appropriate technical and management controls or policies. The board are made aware of the risk, impact and approve a business response.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted at least annually. The risk assessment, along with risk-based analysis and judgment, are used to select security controls to address and to seek to mitigate risks. Factors considered during this process include, but are not limited to, the likelihood and severity of the risk, the impact on the Company and others, such as our customers, if a risk materializes, the feasibility and cost of controls, and the impact of controls on our operations.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: We maintain that no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: Personnel managing our cybersecurity risks rests with our third-party provider, the Company's Director of Information Technology and Director of Software Engineering (referred to as "IT"). Their knowledge, experience and relationship with our third-party vendor are instrumental in developing and executing our cybersecurity strategies.

companyName: AppTech Payments Corp.

ticker: APCX


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or our financial condition. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Cybersecurity breaches and other information security incidents could negatively impact our business and financial results, impair our ability to effectively provide our services to our customers and cause harm to our reputation or competitive position" in this Annual Report on Form 10-K.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: We use governance, risk and compliance tools to assess, identify and manage cybersecurity risks. To address potential cybersecurity events, we have developed an incident response plan that defines protocols and processes for effectively managing our response to an event, including protocols for the escalation of critical information to management, key company personnel and the Board.

companyName: NuStar Energy L.P.


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until discovered.

companyName: LogicMark, Inc.

ticker: LGMK


text: Head of Information Security and cybersecurity stakeholders regularly brief the senior leadership team on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: As part of the Company's framework for cybersecurity risk oversight and governance, the Company's network, information, and data-security policies set forth in the NIDSP Guidelines are enforced by the Company's IT Manager and/or its executive team. The IT Manager is an employee designated by the Company to manage the Company's security policies and program. The IT Manager is tasked with ensuring that the Company maintains compliance with the Company's security policies and any applicable security regulations. The IT Manager is responsible for: (i) implementing the Company's security policies; (ii) disseminating the Company's security policies to all employees; (iii) establishing a training program for all employees and users covered by the Company's IT security policy to notify them of the Company's security policies, train and re-train them to comply with the Company's IT security program, and educate them on the importance of data security; (iv) performing any ongoing testing or analysis of the Company's security infrastructure, policies, and procedures; and (v) updating the NSP and any other policies and guidelines as needed to comply with applicable regulations and to stay up to date with the changing IT security landscape.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: We provide cybersecurity training to employees to raise awareness of the latest threats and best practices for protecting sensitive information. This includes training on how to recognize phishing attempts, handling secure data, and reporting security incidents.

companyName: GT Biopharma, Inc.

ticker: GTBP


text: Board of Directors The audit committee of our Board oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, at least once per quarter, our management team reports on cybersecurity matters, including material risks and threats, to the audit committee, and the audit committee provides updates to the Board at regular Board meetings. Our management team also provides updates annually or more frequently as appropriate to the Board.

companyName: RYVYL Inc.

ticker: RVYL


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from dual-primary data centers in the cloud, with one located in the East US region and the other in the West US region. Either site alone is capable of running all of our essential systems. In addition, we maintain technology operations from regions in East Asia, West US and South Central US regions. Replicated instances of this technology are maintained in our East US region. All regions are built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards. Failover for the majority of our systems is automated.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Our company maintains a comprehensive Information Security Program ("IS Program") focused on detection, assessment and mitigation of cybersecurity risks. Our dedicated enterprise security team, led by our Chief Information Security Officer ("CISO"), administers the IS Program and is responsible for identification, investigation and response to cyber threats and vulnerabilities. The enterprise security team also implements, manages, and assesses our company's cyber policies, standards and procedures, which leverage our team's expertise and the National Institute of Standards and Technology Cybersecurity Framework. We have developed an incident response plan to handle suspected loss of, or unauthorized access to, information. We regularly conduct tabletop exercises, red team exercises, simulations, and other exercises to evaluate the effectiveness of our IS Program and to position our company for a coordinated, strategic response in the event of an actual security incident. All employees are required to complete cybersecurity trainings and employees in higher-risk roles are required to complete additional customized training tailored to address their specific risk exposure. Our Security Operations Center ("SOC"), which operates 24 hours a day, 365 days a year, is designed to provide visibility of security events across the company and a mechanism for swiftly addressing cyber threats before they compromise data security. Through a combination of a threat management platform and our team of cybersecurity specialists, our SOC continuously monitors and proactively isolates and analyzes cybersecurity alerts to help us address cybersecurity risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes and to provide a level of financial protection in the event of cybersecurity incident related costs and losses.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Internally, our training and awareness program creates multi-layered defenses by empowering associates with knowledge and tools to recognize and respond to security risks. Through role-specific and comprehensive training, we seek to maintain a workforce that actively contributes to our cybersecurity goals. Key components of our training program include: • Onboarding Training — All new associates participate in an initial cybersecurity training module at onboarding. This training covers the Company's security policies, data protection standards and foundational security practices helping to ensure that new hires are equipped to meet the Company's expectations pertaining to its security protocols. • Articles — We publish articles on our intranet site for all associates to easily access. These articles highlight emerging threats, industry trends, and actionable tips to help associates enhance their personal and professional security posture. We target critical topics such as ransomware, social engineering, data management, and the latest threats and best practices. • Phishing Simulations — Our phishing awareness program includes continuous phishing simulations conducted on a routine basis. This program helps associates develop the skills to effectively identify and mitigate phishing attempts. Associates who fail a threshold number of simulations during a calendar year are required to undergo additional training. • Cybersecurity Awareness Month Activities — We have implemented interactive, virtual and on-site awareness activities during Cybersecurity Awareness Month in October. These activities include phishing simulations, articles, lunch and learns, and gamification to serve as refreshers on critical security concepts and reinforce our commitment to maintaining a security-conscious culture.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Hubbell's cybersecurity program is managed by a dedicated CISO who has over a decade of information technology and program management experience. The CISO is responsible for leading our enterprise-wide cybersecurity program and assessing, monitoring, and managing our cybersecurity risks. These responsibilities include overseeing cybersecurity governance programs, testing our compliance with standards, remediating known risks, completing cybersecurity risk management activities related to acquisition due diligence and integration, and leading our employee cybersecurity training program. The CISO stays current with the latest developments in cybersecurity and the evolving threat landscape to inform cybersecurity prevention, detection, mitigation, and remediation efforts. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes processes to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a detailed incident response plan which outlines the steps to be followed from incident detection to mitigation, notifications, and recovery. Notifications include functional areas (including legal), senior management and the Board, as applicable. We have adopted and enforce various enterprise-wide policies relating to cybersecurity, to ensure the ongoing protection of our systems including, policies to identify, classify, and protect company data, manage vulnerabilities, and perform user access reviews. We further conduct drills of our incident response plan to prepare incident response teams and provide cybersecurity training and phishing simulations throughout the year via our enterprise learning management systems.

companyName: HUBBELL INC

ticker: HUBB


text: Reliance mandates regular cybersecurity training for employees and applicable contractors designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training covers various cyberattack methodologies, including insider attacks, phishing and other forms of social engineering, and other email attacks, malware attacks, data protection, data handling, password protections, cloud and internet security and cybersecurity fundamentals for mobile devices. We take a risk-based approach with respect to our use and oversight of third-party service providers, using a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors, and negotiating for cybersecurity-related terms in vendor agreements as appropriate. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.

companyName: RELIANCE, INC.

ticker: RS


text: Notwithstanding the Company's defensive measures and processes, the threat posed by cyber-attacks is severe. The Company's internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while it has experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company. For further discussion of risks from cybersecurity threats, see the section captioned "An interruption in or breach in security of the Company's information systems may result in a loss of customer business and have an adverse effect on the Company's results of operations, financial condition and cash flows" in Item 1A. Risk Factors.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: We are committed to preserving the trust and confidence of our stakeholders by taking appropriate technical and organizational measures for maintaining information security and data privacy. Our cybersecurity program allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness and incident response procedures. We have established policies and procedures to ensure timely and appropriate notifications to relevant parties and regulators as required for cybersecurity threats and data breaches.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: We engage assessors, consultants, auditors, or other third parties in connection with any such processes, including: • external vulnerability assessments, including penetration tests; • internal audit reviews; • threat intelligence; • incident management; • audits of NERC-Critical Infrastructure Protection regulated environments by the NERC Registered Regional Entity; and • program development support, as needed.

companyName: IPALCO ENTERPRISES, INC.


text: Notwithstanding our efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Nor are we insured for damages that could result from such an incident.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "If we or our third-party partners experience a security breach, other hacking or phishing attack, ransomware or other malware attack, or other privacy or security incident, our work marketplace may be perceived as not being secure, our reputation may be harmed, demand for our work marketplace may be reduced, our operations may be disrupted, we may incur significant legal costs, fines, or liabilities, and our business could be adversely affected."

companyName: UPWORK, INC

ticker: UPWK


text: Murphy USA relies on numerous third-parties to deliver the goods and services offered to our customers. We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate risks associated with third-parties; however, we rely on those third-parties to implement security programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. For the 2023 period presented within this Annual Report, Murphy USA is not aware of any threats or cybersecurity incidents that have or are reasonably likely to materially affect our strategy, results of operations or financial condition.

companyName: Murphy USA Inc.

ticker: MUSA


text: The Sponsor's Chief Information Security Officer ("CISO") is responsible for overseeing the Trust's cybersecurity practices. The CISO also manages IT affecting the Trust. The CISO is responsible for overseeing the ongoing adequacy of design and effective implementation of these policies and procedures and to review these procedures at least annually. The CISO is trained as a computer scientist (Master of Science) with extensive programming and system administration experience. The CISO's background includes study of many of the IT building blocks of a modern office infrastructure, including the study and programming of network protocols, information theory, public key cryptography.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. We designed and assess our cybersecurity risk management program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as well as information security standards issued by the International Organization for Standardization, including ISO 27001, which we use as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our global information security management program is ISO 27001:2022 certified.

companyName: FLEX LTD.

ticker: FLEX


text: The company maintains a program, run by the company's Vice President of Global Information Technology and Information Security, overseen by the company's Chief Financial Officer, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by or in the care of the company. The company has implemented a cybersecurity incident response plan that provides controls and procedures to facilitate timely and accurate reporting of any material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by a designated cybersecurity team using established risk criteria. If a cybersecurity event meets certain of these criteria, it is escalated to an internal cross-functional Cyber Incident Response Team and external incident responders. The company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The plan also contains procedures for escalating cybersecurity incidents to the Board of Directors.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on a periodic basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below.

companyName: COMMUNITY WEST BANCSHARES /


text: Our cybersecurity governance and strategy program to prevent, detect, manage, mitigate, and remediate cyber threats is comprised of: • Controls based upon the NIST Cybersecurity Framework for enterprise governance, critical asset management, internal and third-party risk management, segregated access control management, data security and protection, anomaly logging and general security monitoring, incident response, security training and awareness, and disaster recovery testing. • Security Policies and Procedures for cybersecurity, incident response, acceptable use, change control, disaster recovery, backup and recovery, business continuity, business operations recovery, third-party vendor security assessments, vulnerability and patch management, data privacy, and various regulatory compliance areas. • Enterprise Risk Management to identify, assess and mitigate internal and third-party risks in a continuous life cycle program which is also based on the NIST Cybersecurity Framework. This risk management framework incorporates corporate and business segment SCADA (Supervisory Control and Data Acquisition) system risks for an integrated enterprise approach. • Various Cybersecurity Systems and Protocols for aggregated monitoring and behavior analytics, detection and response, network protection and segmentation, layered security methods for defense-in-depth, vulnerability and patch management, backup and recovery, and asset management. • Employee Education for continual security awareness and threat diligence. The program includes a myriad of monthly and quarterly required cyber training for high-risk areas plus mandatory semi-annual training for all employees and third parties with access to our network. Additionally, monthly simulated phishing campaigns and newsletters reinforce cyber risks and general security awareness.

companyName: NGL Energy Partners LP

ticker: NGL


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the section titled "Risk Factors" in Item 1A of this Annual Report on Form 10-K, including the risk factor titled "—Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."

companyName: Nuvation Bio Inc.

ticker: NUVB


text: A team of IT Specialists (including a dedicated Senior Cybersecurity Analyst) at our Company monitors cybersecurity and operational risks associated with information security and system disruption. This team employs measures aimed at protecting against, detecting, and responding to cybersecurity threats, and has implemented processes and procedures in line with our information security management system to bolster and advance resilient programs. This encompasses:

companyName: WEYCO GROUP INC

ticker: WEYS


text: Use of Cybersecurity Experts Due to the complex and evolving cybersecurity threat landscape, BBSI engages third-party experts to conduct in-depth threat assessments, identify vulnerabilities, monitor and detect threats, and offer strategic insights into our risk management process. Leveraging the knowledge, expertise, and resources of third-party experts, we regularly evaluate our cybersecurity risk management strategy to help us align with best practices and address cybersecurity threats that could impact our ability to achieve our business objectives.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address the threat landscape, we maintain a cybersecurity risk management strategy that is designed to identify, assess, manage, and address cybersecurity threats that may have a material impact on our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of service providers when handling and/or processing our employee, business or customer data. Further, in February 2024, we formalized our policy of monitoring third-party cybersecurity risks by requiring its consideration and approval by the IT change control board as a part of vendor selection and solution procurement.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: Cibus has processes designed to protect its information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability practices. The Company's cybersecurity team has dedicated personnel whose responsibilities include preventing and monitoring cybersecurity threats. The team has a cybersecurity incident response plan, which is a dynamic and flexible basic framework that includes processes designed to address interdiction and remediation, conducting initial investigations, gathering and analyzing data, reporting incidents to management, mitigating damage to the Company's informational assets and infrastructure, restoring normal services and system integrity, and implementing actions designed to prevent future cybersecurity incidents.

companyName: Cibus, Inc.

ticker: CBUS


text: Board of Directors considers cybersecurity risk as part of its oversight function. Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for overall cybersecurity risk management and is responsible for updating the Board, as necessary regarding significant cybersecurity incidents.

companyName: Global Arena Holding, Inc.


text: Our information technology department helps identify, assess and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans; vulnerability testing, such as phishing simulations; and analysis of reported threats.

companyName: Longboard Pharmaceuticals, Inc.


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information, and other confidential data that we collect and use in connection with our business, and the importance of assessing, identifying, and managing various cybersecurity risks that may impact our business. As such, we have implemented an information security program, which includes cybersecurity risk management measures intended to prevent, detect, and respond to malicious cyber activities and other security incidents that could adversely affect the confidentiality, integrity, or availability of our, or our customers' information or information systems.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: We undertake to align our cybersecurity program, which encompasses both enterprise security and operational security, with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. In addition to security measures for third-party vendors, we require onboarding orientation and periodic training covering cybersecurity and information management for all employees and board members and conduct regular cybersecurity awareness campaigns.

companyName: Transocean Ltd.

ticker: RIG


text: We engage third-party cybersecurity experts to provide independent assessments of our cybersecurity readiness and control effectiveness. Our goal in collaborating with external cybersecurity firms is to gain insights and knowledge into emerging threats and vulnerabilities, industry trends and best practices to inform our risk remediation efforts. Additionally, we engage with our externally retained incident response team and select internal teams to perform tabletop exercises that inform our cybersecurity response capabilities and resilience.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: As a healthcare organization, we manage large quantities of protected health information ("PHI"), personally identifiable information ("PII"), and other sensitive data. Recognizing the heightened risks posed by cyber threats, we have implemented a comprehensive cybersecurity framework that is designed to proactively identify, assess, and mitigate the risks associated with these threats. This includes protection against ransomware, phishing attacks, data breaches, and the evolving tactics of sophisticated cyber adversaries, as well as other types of cyber threats. Our cybersecurity program is built upon industry-recognized standards and, and we continuously adapt our program to defend against the changing threat landscape.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Technology Steering Committee meets on at least a quarterly basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Company. The Technology Steering Committee is chaired by the CIO and reports to the Board of Directors through Committee minutes. The Technology Steering Committee is comprised of numerous members of the senior executive team, as well as the ISO.

companyName: TFS Financial CORP

ticker: TFSL


text: Management's Role Managing Risk Our CIO plays a pivotal role in informing the Risk Committee on cybersecurity risks and developments. Our CIO provides comprehensive briefings to the Risk Committee on a regular basis, with a minimum frequency of four times per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events;

companyName: Hilltop Holdings Inc.

ticker: HTH


text: In addition, under the program we employ additional key practices including, but not limited to, maintenance of an information technology ("IT") assets inventory, periodic vulnerability testing, identity access management controls including restricted access of privileged accounts, physical security measures at our offices, maintenance of firewalls and anti-malware tools, ongoing cybersecurity user awareness training, industry-standard encryption protocols, and critical data backups.

companyName: Sachem Capital Corp.

ticker: SACH


text: We place a high priority on securing confidential business information and the sensitive personal information we receive and store about our consumers, customers and employees. We have systems in place to securely receive and store that information and to detect, contain, and respond to cybersecurity incidents. We also have processes to manage risk from cybersecurity threats associated with third parties, including service providers, such as risk assessments and contractual requirements that include cybersecurity measures. In addition, we have a cybersecurity and information security training and compliance program in place to support our teams who work in areas of cybersecurity and information security risk. As part of this program, VF associates who have access to confidential information receive training at least annually on cybersecurity and information security. To respond to the threat of security breaches and cyberattacks, VF maintains a program, overseen by VF's CISO and CSBDO, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by, or in the care of, VF. This program also includes a cyber incident response plan that provides processes for timely and accurate reporting of any material cybersecurity incident. Our CISO has over thirty years of experience as a cybersecurity professional, including experience as the CISO of two large retailers, and reports to our CSBDO, who leads our digital and technology functions and has nearly twenty years of experience enabling digital transformation for global companies. In addition, members of VF's information security, IT and privacy teams have broad experience and expertise in selecting, deploying and operating cybersecurity technologies, initiatives and processes around the world. VF also engages service providers, consultants and other third parties in connection with these processes to provide augmented cybersecurity capabilities, deliver strategic advice, provide assurance regarding the effectiveness of certain processes and assist in cybersecurity incident response efforts, as needed. VF also maintains a cybersecurity risk insurance policy.

companyName: V F CORP

ticker: VFC


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: Inuvo, Inc.

ticker: INUV


text: of Processes for Assessing, Identifying, and Managing Cybersecurity Risks the normal course of business, we may collect and store certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. Our access control policies are based on the principle of least privilege, limiting user access strictly to what is required for their roles. Additionally, we have general measures to identify potential threat actors, including the implementation of two-step verification processes to confirm the identity of all counterparties.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: Entergy's CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence. The CSO's background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company. The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. Incidents are reported to and handled under our Incident Response Policy, which designates an incident response team and includes procedures and processes to identify, assess, respond to, mitigate and report on cybersecurity incidents.

companyName: First Internet Bancorp

ticker: INBK


text: We conduct due diligence security assessments of certain third-party providers before engagement, have contractual rights to and gather data on the effectiveness of vendor systems and protocols and monitor compliance with our cybersecurity standards. The monitoring includes periodic assessments and ongoing monitoring by the IT Security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: Endo International plc


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology and management. Personnel at all levels and departments are made aware of our cybersecurity policies through internal communications, training and annual policy updates, and are requested to promptly report any suspected breach of our information systems to management. Additionally, we have implemented annual security training for all employees and staff, which includes targeting the recognition of phishing campaigns.

companyName: Peraso Inc.

ticker: PRSO