text: The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program. The audit committee and the board of directors receive presentations on cybersecurity topics from our COO as part of continuing education on topics that impact public companies.

companyName: Erasca, Inc.

ticker: ERAS


text: Furthermore, as part of our cybersecurity management, we are committed to strong third-party risk management. We actively and routinely address cybersecurity capabilities with our top-tier suppliers and have implemented cybersecurity requirements in our standard supplier contract terms to address cybersecurity risk. Additionally, we validate cybersecurity practices of key suppliers as may be necessary to comply with applicable regulations or flow-down requirements from our customers.

companyName: HEXCEL CORP /DE/

ticker: HXL

secItem: Item 1C


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk and is aligned to our business goals and strategy. Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of technologies, products, specialized IT tools and external service providers, where appropriate, to assess, test, understand, manage, mitigate and continually remediate identified risks, or otherwise assist with aspects of our security procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Terran Orbital Corp


text: The Company's cybersecurity environment is led by its Chief Executive Officer and sole director, who in addition to cybersecurity matters, oversees the Company's IT infrastructure and is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats. The Company establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems.

companyName: Onar Holding Corp

ticker: ONAR


text: The following individuals have primary responsibility for assessing and managing cybersecurity risks: • Chief customer officer ("CCO"), who oversees the digital transformation, digital technology and security functions • Chief digital information officer ("CDIO"), who oversees enterprise-wide digital transformation • Chief information security officer ("CISO"), who oversees the security function and reports to the CCO • Chief technology officer ("CTO"), who oversees product engineering and advanced technologies • General Counsel, who oversees the legal and compliance functions These individuals, among others, also serve as members of management's Security Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.

companyName: ServiceNow, Inc.

ticker: NOW


text: Through a cross-functional team, we assess and mitigate risks associated with our third-party providers and have processes in place to regularly monitor and evaluate cybersecurity risks, threats and incidents associated with the use of third-party providers, as well as monitoring rights, as appropriate. Our information security team, overseen by our Chief Information Security Officer ("CISO"), conducts annual information security awareness training for employees involved in our systems and processes that handle customer data. We also conduct periodic cybersecurity awareness training with management and the Board of Directors, including cybersecurity preparedness exercises. In addition, the DSCP includes an incident response plan, which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to assess the materiality of the incident, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal reporting and other obligations and mitigate reputational damage. We also carry insurance that provides protection against certain losses arising from a cybersecurity incident.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Any changes or additions to our cybersecurity program and related practices and procedures described above in response to cybersecurity needs are reviewed by our executive management, Board of Directors and Audit Committee.

companyName: Trane Technologies plc

ticker: TT


text: The Board, through its Enterprise Risk and Technology & Operations Committees, oversees the Bank's Information Security and Enterprise Risk Management programs, which include the Information Security Policy. The Board receives reports from the Enterprise Risk and Technology & Operations Committees, which are management committees composed of members of the Bank's senior management responsible for management of risk and implementation of the cybersecurity risk management framework within the Risk Management Program as approved by the Board. The Board oversees management's approach to staffing, policies, processes, and practices to measure and address cybersecurity and information security risk.

companyName: Federal Home Loan Bank of San Francisco


text: Each CSSC meets quarterly and reports to the Company's senior management team, including the Corporate Compliance Officer, on progress towards specific cybersecurity objectives. A strong partnership exists between our information technology, enterprise security, internal audit, and legal and compliance functions so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: The Committee receives frequent, and typically no less than quarterly reports from management on our cybersecurity risks, assessment of our cybersecurity program, and development of our information security incident response plan. In addition, management updates the Committee, pursuant to an agreed upon timetable and escalation matrix regarding any material cybersecurity incidents, as well as providing the Committee with periodic reports on any incidents with lesser impact potential.

companyName: ATN International, Inc.

ticker: ATNI


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: Education and Awareness. PMI regularly provides its workforce with mandatory cybersecurity awareness education and training addressing information security related tasks in line with our evolving information security policies, standards, procedures, and practice as well as supplemental role-based training and awareness programs.

companyName: Philip Morris International Inc.

ticker: PM


text: We have a written incident response plan that identifies the steps to be taken in response to a cybersecurity incident that includes investigation, escalation and remediation provisions. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Targeted security assessments were conducted and penetration tests throughout the year by internal teams as well as through engagement with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: Treasure Holdco, Inc.


text: 4. Audit and Testing: Independent third-party penetration testing, IT Control Audits, and vulnerability assessments are completed at least annually to test the effectiveness of security controls and preparedness measures (or more often if warranted by the risk assessment or other external factors). The Information Security Officer determines the scope and objectives of the penetration analysis. Results of audit and testing are reported to the IT Steering Committee for management and the board of directors for oversight.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts.

companyName: Digital Locations, Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel) and cybersecurity consultants. We also use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, application providers, and supply chain resources. We manage cybersecurity risks associated with our use of these providers by, for example, requesting and analyzing responses on a security questionnaire and conducting audits and risk assessments on certain vendors. In particular, our legal department performs an assessment on each vendor and based on certain criteria will have our IT team perform a security assessment.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: Our VPO and acting CISO, who reports to our President, is responsible for the day-to-day management of our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, with the assistance of and informed by our consultants. Our VPO and acting CISO, who has many years of senior management and operational oversight at emerging technology companies, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the day-to-day management of our information technology consultants, which includes engaging with information provided by the consultants, automated monitoring and detection systems, and other tools and processes defined by our cybersecurity policies.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations or financial condition.

companyName: Marpai, Inc.

ticker: MRAI


text: The Company regularly updates and assesses its information security strategy and responses for new and emerging threats. To date, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial position. Notwithstanding the breadth of the Company's information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Also see "Risks Related to Technology, Data Security, and Privacy" included as part of Item 1A. "Risk Factors," which is incorporated by reference herein.

companyName: FOOT LOCKER, INC.


text: Our cybersecurity program is led by our Chief Technology Officer ("CTO") who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CTO has extensive information technology and program management experience and many years of experience with our organization. Our CTO reports to our president and CEO.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework to report and document such incidents to our cybersecurity incident response team. This framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. Cybersecurity incidents are regularly reported to the Chief Information Officer and certain critical events are reported to the CEO and the crisis management team comprised of senior executives. We also have protocols in place by which certain cybersecurity incidents are reported to the Board of Directors as part of their oversight of cybersecurity matters.

companyName: FLUOR CORP

ticker: FLR


text: Our IT risk management processes are integrated into our Enterprise Risk Management (ERM) program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. Our ERM program is overseen by our Enterprise Risk Committee ("ERC"). Our ERC is comprised of various members of senior management, including our Chief Information Officer ("CIO") and internal audit and compliance department leaders. The ERC is responsible for the governance of enterprise risks assessments, identification and management of internal risks, and development of related mitigation strategies. See "Risk Factors – Information system failures, cyber incidents or breaches in security could adversely affect us" for further information on how cybersecurity threats could harm our business, financial condition, and results of operations.

companyName: Excelerate Energy, Inc.

ticker: EE


text: The Company relies on technology in all aspects of its business, including information systems of its third-party service providers. The information systems upon which the Company depends have been, and will likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. The Company's dependence exposes it to cyberattacks, both directly and through cyberattacks impacting its service providers. A significant cybersecurity incident at the Company or its service provider could result in service interruptions, safety failures, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, the Company continuously monitors its cybersecurity threats, including risks associated with its user of service providers. The Company is not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected the Company's business strategy, results of operations or financial condition.

companyName: BURLINGTON NORTHERN SANTA FE, LLC


text: Our Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities, including but not limited to cybersecurity risk, to the Nominating and Governance Committee. Specifically, the Nominating and Governance Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness.

companyName: KORU Medical Systems, Inc.

ticker: KRMD


text: Our CIO serves as head of Vistra's Technology Services and is responsible for ensuring the reliability, security, and continued development of the Company's technology platforms and delivering new solutions to support the business. The CIO has served in various senior information technology roles in public companies for over 30 years, including Keurig Dr. Pepper Inc., General Motors, Pfizer, and Electronic Data Systems.

companyName: Vistra Corp.

ticker: VST


text: As part of its overall Enterprise Risk Management (ERM) program, the Company identifies and assesses cybersecurity risks on an annual basis. The ERM program includes identification, assessment and management of risks, including cybersecurity risks. Business process owners incorporate risk management philosophy, exposures, mitigating activities, and key indicators to develop strategies and actions. The ERM Steering Committee, comprised of senior level executives, is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation actions, and assisting the Board of Directors in overseeing the Company's cybersecurity risks.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: Our cybersecurity and data privacy risk management processes are integrated in our overall risk management program, and we have developed processes for assessing, identifying, and managing material risks from cybersecurity threats. We have adopted physical, technological, and administrative controls on data security and have a defined procedure for incident detection, containment, response, and remediation. Our information security team is primarily responsible for managing our cybersecurity processes and partners with our legal team on data privacy risk management processes. We conduct regular test exercises to ensure all relevant teams are aware of their responsibilities during a cybersecurity event or incident, and we use these exercises to promote a culture of continuous improvement. We also have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: UPWORK, INC

ticker: UPWK


text: Our Chief Information Officer, our Senior Director of Information Technology, our Director of Business Systems Applications and our Information Technology Security Manager oversee our cybersecurity program. Collectively, the team has decades of information technology experience and our Information Technology Security Manager holds a masters degree in Network Security. They meet on a regular basis and report to the Audit Committee at least annually on key cybersecurity risks as well as current and future cybersecurity strategy. As delegated by our Board of Directors, our Audit Committee is responsible for reviewing, with management, our internal control systems with respect to information technology security. The Audit Committee Chairperson is also involved in our annual overall risk assessment process. In addition to the foregoing, from time to time, the Board of Directors is updated concerning the Company's internal control systems with respect to information technology security.

companyName: FIRST INDUSTRIAL LP


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Director of IT and department staff. Our IT team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Chief Information Security Officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity posture. These partnerships enable us to leverage specialized knowledge and insights in the development of our cybersecurity program consistent with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: HUNTSMAN INTERNATIONAL LLC


text: She holds an undergraduate degree in Information and Decision Sciences. Our EVP OP has extensive enterprise risk management experience, developed over more than 25 years while holding senior leadership positions, including group CIO and divisional COO roles, at global brokerage and risk management firms, and serving clients as a management consultant. He holds an undergraduate degree in accounting.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: The dedicated Security function, led by the SVP Enterprise Technology and Security, effectively manages cyber risks while enabling business innovation and technology solutions. The team employs a multifaceted approach to cybersecurity, including prevention, detection, mitigation, and remediation of risks and incidents. Relevant efforts leverage internal security expertise, external consulting services, threat intelligence, alerts from advanced security tools deployed across our technical environments, other information obtained from government, public or private sources, and our security service providers.

companyName: Beachbody Company, Inc.

ticker: BODI


text: To be prepared for any natural or cybersecurity incident involving sensitive data breach across employees, customers, contractors, or vendors; and/or affecting service availability for the organization or customers, a comprehensive incident response plan along with disaster recovery & business continuity plan has been documented. The plan contains details on aspects including but not limited to – incident identification, operational playbook and responsibility matrix, communication and notification procedures, and reporting to legal/governing bodies based on severity of the incident. C level executives and the board are notified if warranted by the severity of the incident.

companyName: Crexendo, Inc.

ticker: CXDO


text: However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: ASPAC II Acquisition Corp.

ticker: ASCBF


text: The chair of the cybersecurity steering committee, our executive director of cybersecurity, has over 25 years of information technology industry experience including 20 years focused on cybersecurity, and master's degrees in a cybersecurity discipline and in business administration, in addition to multiple certifications related to information technology and cybersecurity.

companyName: Sage Therapeutics, Inc.


text: We outsource our information technology managed services to a third-party provider of customized private cloud solutions featuring virtual desktops and servers ("MS Provider"). Our Director of Information Technology, together with BDO, oversees the MS Provider.

companyName: LXP Industrial Trust

ticker: LXP


text: There have not been any breaches at the Manager or the Fund during the year ended June 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STARTENGINE CROWDFUNDING, INC.


text: Although we have not experienced any material cybersecurity incidents, a future incident could materially affect us. We rely on information technology to process, transmit and store electronic information, and to manage or support a variety of business processes, including financial transactions, PII, and resident and lease data. Our business requires us and some of our vendors to use and store PII and other confidential and sensitive information of our residents and associates. Any failure in or breach of our operational or information security systems or those of our vendors as a result of cyber-attacks or other security incidents could materially adversely impact our operations and financial position, including disruption of our operations caused by an inability to access network systems, disclosure or misuse of confidential or proprietary information (including PII of our residents and/or associates), damage to our reputation, and/or potentially significant legal and/or financial liabilities and penalties.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: To date, we have not experienced any cybersecurity incidents that have had a material affect on the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Regulation and Supervision –Cybersecurity" included in Part I. Item 1 – Business of this report.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.

companyName: TaoWeave, Inc.

ticker: TWAV


text: The Audit Committee of the Company's Board of Directors (the Audit Committee) oversees the Company's cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company's Vice President of Information Technology. The Company's Vice President of Information Technology, who reports to the Vice President and Chief Financial Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's Vice President of Information Technology has served in a variety of IT and cybersecurity roles for twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company's Cybersecurity Manager, who reports to the Vice President of Information Technology, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company's cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company's cybersecurity team provides periodic reports to such auditors.

companyName: STEPAN CO

ticker: SCL


text: The CIRT meets with the CEO and other members of our senior management on a quarterly basis and meets with the Audit Committee at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.

companyName: Ecovyst Inc.

ticker: ECVT


text: To address cybersecurity risks associated with third-party service providers, we have established procedures, policies, and tools for identifying, assessing, and mitigating potential threats. This process begins with a third-party risk assessment, which is performed and updated as needed. Our Information Security Guidelines for Suppliers ensure compliance with security standards, while our Access Control Policies regulate third-party access to sensitive systems, and our Cloud System Information Security Procedures govern data security in cloud environments.

companyName: Ondas Inc.

ticker: ONDS


text: Our Cybersecurity Management System (CSMS) is part of our cybersecurity program and operates under the Ansys CSMS Risk Management Methodology and Policy (Policy), which establishes a process to identify, assess and mitigate potential cybersecurity threats. The Policy provides for conducting risk assessments to identify Ansys information assets (such as software assets or data), identifying potential vulnerabilities related to those assets, assessing the potential impact should the vulnerability be exploited and working with our internal cybersecurity team to provide recommendations to eliminate or mitigate the potential risk. The risk assessments allow our management to validate threats and investigate potential vulnerabilities to more effectively make risk management decisions and assign resources to mitigate risk.

companyName: ANSYS INC


text: The Company's cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. The cybersecurity program and policies are operated by a dedicated cybersecurity team in conjunction with the Company's enterprise risk management program.

companyName: Dave Inc./DE

ticker: DAVE


text: The adequacy of security measures used by service providers for internal information will be evaluated in connection with the risk assessment process outlined below in the section labeled Risk Assessment. The CISO is responsible for classifying information, identifying risks, and identifying risk mitigation strategies. The CISO is also responsible for evaluating the adequacy of risk mitigation strategies prior to deploying any Information System. Externally hosted applications (those not installed on the Sponsor's local network and servers) are reviewed by the CISO at least annually thereafter.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees tools to manage and defend against the most relevant and prevalent cybersecurity risks to AbbVie. We also provide specialized training for employees in specialized information technology roles. We conduct regular drills, such as tabletop exercises, to help with our overall preparedness.

companyName: AbbVie Inc.

ticker: ABBV


text: We have implemented a vendor risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers in response to detailed questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. Contract language, purchasing decisions, and/or technology implementation strategies are frequently adjusted as a result of this process.

companyName: GRESHAM WORLDWIDE, INC.


text: e. Our cybersecurity team conducts semi-annual cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct quarterly simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Risk Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and integrated these processes into our overall risk management systems and processes. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Peraso Inc.

ticker: PRSO


text: The CISO, through Exelon's Cyber Information and Security Services (CISS), reviews external and internal sources to obtain cyber threat intelligence to develop strategic and tactical threat assessments that inform the enterprise-wide cyber risk mitigation programs and actions. Exelon uses a wide range of tools, including endpoint, anomaly and network detection, logging and monitoring of security events, network segmentation, firewalls, hardening and securing devices, cyber vulnerability detection and patch management, cyber threat hunting, malware forensic analysis, industry-specific reports, and tabletop exercises to inform the cybersecurity management team. Exelon protects assets critical to grid reliability and national security through the implementation of the North American Electric Reliability Corporation's Critical Infrastructure Protection requirements, and gas pipeline security under the U.S. Department of Homeland Security's Transportation Safety Administration's Security Directives. Exelon maintains security relationships with law enforcement and U.S. intelligence agencies, coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC) and participates in the Department of Energy's Cybersecurity Risk Information Sharing Program (CRISP) to strengthen the security of the energy grid, develop and deploy new technologies, share information, design and participate in drills and exercises such as the bi-annual Grid Security Exercises and facilitate cross-sector coordination. Exelon applies stringent employee and contractor screening, and advances security awareness through training and monitoring programs that address both cyber and physical threats. Exelon employees are subject to annual mandatory training addressing security awareness, including cybersecurity and phishing. Exelon maintains cyber insurance coverage at limits consistent with the utility industry and reviews policy coverage and limits on an annual basis.

companyName: EXELON CORP

ticker: EXC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Information technology failures and data security breaches could harm our business," which discussion is included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: TEJON RANCH CO

ticker: TRC


text: Oversight and Governance Under the ultimate direction of our Chief Executive Officer and executive management team, our Information Security Core Committee has primary responsibility for overseeing our management of cybersecurity risks. This committee is chaired by our Chief Information Security Officer, or CISO, who reports directly to our Chief Risk Officer. Other members of the committee include representatives from Information Technology, Operations, Privacy, Compliance, BSA, Audit. Business Continuity, Vendor Management, Human Resources, Physical Security, Unified Fraud, Retail, Wealth Management, Lending, and Enterprise Risk Management.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A "Risk Factors—Risks Related to Our Company—Operational risks (including those associated with our business model), system security risks, breaches of data protection, cyberattacks, or actions or failure to act by our employees or others with authorized access to our networks, including our ability to insure against such risks, may disrupt our businesses, result in losses, or limit our growth."

companyName: Carlyle Group Inc.

ticker: CG


text: We are focused on the growing threat of cybersecurity risks we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and focuses on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information. We have an established incident response plan ("IRP") to respond to cyber incidents.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: Although many of the networks are segmented, overall network security is a centralized shared service across the Southern Company system, led by the TSO and the CISO. Recognizing that no single technology, process, or business control can effectively prevent or mitigate all risks related to cyber threats, multiple technologies, processes, and controls, all working independently but as part of a cohesive strategy, are employed to reduce risk. Southern Company system exposure and defenses are regularly tested through auditing, penetration testing, vulnerability testing, and other exercises designed to assess effectiveness.

companyName: SOUTHERN CO GAS


text: As set forth in its charter, the ROC has the responsibility to review reports from management relating to enterprise-wide risk management efforts, including cybersecurity risks. As part of that oversight, the ROC performs an annual review and approval of information security policies and programs, and receives regular updates on key risk indicators, threat trends, risk remediation activities, and operational events. The ROC periodically provides reports regarding this oversight to the Board. Management uses multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. Documented escalation procedures are tested regularly as part of tabletop exercises and other activities and include notification to executive management during qualifying cybersecurity incidents.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Global IT Manager implements and oversees processes for regularly monitoring our IT systems. This includes deploying security measures to identify potential vulnerabilities. The Global IT Manager runs an incident response plan for a cybersecurity incident. This plan provides actions to mitigate the impact and long-term strategies for remediation and preventing future incidents.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Consistent with overall Company policies and practices, the Company's cybersecurity program focuses on the following areas:

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: We understand the importance of preventing, identifying, assessing and managing material risks associated with cybersecurity threats. Cybersecurity processes to identify, assess and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and are designed to help protect our information assets and operations from internal and external cyber threats and protect employee and patient information from unauthorized access or attack, as well as secure our network and systems. We have implemented into our operations these cybersecurity processes, technologies and controls to identify, assess and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic internal and external penetration testing by an independent cybersecurity firm to inform our risk identification and assessment of critical, high, medium and minor material cybersecurity threats.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: Our cybersecurity risk management is designed to employ technology and security practices across our operations and business functions, including vulnerability assessments, detecting and responding to cyber security incidents, cybersecurity crisis preparedness and incident response resources, vulnerability scans and IT security risk assessments, and progressive investments in cybersecurity infrastructure and technology designed to reduce cybersecurity risks. Notable aspects of our cybersecurity risk management include: efforts towards adoption of the National Institute of Standards and Technology (NIST), Cybersecurity Framework; periodic IT risk assessments conducted by an external cybersecurity consultant; enterprise-wide security and privacy measures; IT security, cybercrime, privacy, and HIPAA security training provided to employees and independent contractors; periodic social engineering and phishing testing for employees; encrypted and air-gapped data backups; periodic dark web monitoring and vulnerability scans; and periodic review of disaster preparedness, incident response, and business continuity plans.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: The techniques used to obtain unauthorized access, to disable or degrade service or to sabotage systems change frequently. As a result, we have invested and continue to invest in the security and resiliency of our networks to help protect our Information Systems and Data. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity and Intellectual Property" section of this Report.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Third Party Service Provider Risk Management Vendor risk assessment is part of the Company's cybersecurity program, which facilitates management of third-party service providers' IT-related risks. Third-party service providers that have access to the Company's network, data and information are subject to a cybersecurity due diligence process and the corresponding security contractual and control requirements based on the nature of the engagement. The vendor risk assessment process is reviewed at least annually.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We address cybersecurity risk with input from our employees and Audit Committee. The Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a universal view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. Our information technology (IT) security team reviews enterprise risk management-level cybersecurity risks annually. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: We maintain a cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. This program is managed by a team of full-time employees, overseen by our Information Security Officer, as part of our Information Services team. Our Information Services team is tasked with conducting our day-to-day information technology operations. Furthermore, we consider cybersecurity risks as part of, and have incorporated our cybersecurity program into, our overall risk management processes.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and employee training activities. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: HESS CORP


text: We have implemented administrative, physical, and technical safeguards and processes to assess, identify, and manage material risks from known cybersecurity threats to our Information Systems and operations. However, our Information Systems could be disrupted, degraded, destroyed, or manipulated intentionally or accidentally by our employees, third parties with authorized access, or cyber threat actors, which could negatively and adversely impact key business processes. The size and complexity of our Information Systems, as well as those of our third-party providers, make them potentially vulnerable to such service interruptions. Additionally, we and our third-party providers have experienced and expect to continue experiencing phishing attempts, network scanning attempts, and other unauthorized access attempts to our computers, Information Systems, networks, and devices. These increasingly sophisticated attacks are carried out by groups and individuals with various motives and expertise, including state and quasi-state actors, criminal groups, hackers, and others. Such attacks could result in the loss of confidentiality, integrity, and/or availability of our data and Information Systems.

companyName: Embecta Corp.

ticker: EMBC


text: Our CISO, has over 20 years of experience in the technology and cybersecurity, including senior leadership roles in software security, penetration testing, and incident response. Our CISO attained and maintains multiple security certifications including CISSP (Certified Information Security Professional). Prior to Nextdoor, our CISO led Software Security at the Federal Reserve's National Incident Response Team.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: Our cybersecurity risk management program includes: • assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and • a risk evaluation of the service providers, suppliers, and vendors of critical systems during contracting.

companyName: CG Oncology, Inc.

ticker: CGON


text: The Audit Committee receives regular reports from management on our cybersecurity risks and reports regarding IT internal controls in connection with its oversight of internal control over financial reporting. In addition, management updates the Audit Committee, as necessary, regarding any significant or potentially significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, and the impact, if any, of cyber incidents on internal control over financial reporting. Audit Committee members also receive presentations on cybersecurity topics from our Chief Information Officer and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Custom Truck One Source, Inc.

ticker: CTOS


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: For more information about these risks, see the risk factor titled "The Company relies on its information and communications systems in its operations. Security breaches and other disruptions could adversely affect its business and results of operations" under Item 1A.

companyName: STURM RUGER & CO INC

ticker: RGR


text: The Company also has an internal Cybersecurity Committee comprised of leadership across multiple internal functions that meets regularly to review, with the Director of Global Cybersecurity and the Chief Information Officer, active and thwarted cybersecurity incidents, systemic threats, attack trends and techniques, counter and preventative measures and defenses being implemented to enhance security. The meetings are also conducted for: ongoing awareness among Company leadership about cybersecurity threats and incidents; discussion of strategies for continuous improvement and associated capital needs; and review of oversight, governance and reporting of cybersecurity matters.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: As part of its regular oversight of risk management, our audit committee is responsible for the oversight of cybersecurity risk and threat mitigation related to our information technology and information systems including protection and security of employee and customer data. Our Senior Vice President – Technology Solutions is responsible for the day-to-day management of our cybersecurity program and reports directly to our President. Our Senior Vice President – Technology Solutions has served in this role for over four years and has more than 25 years of experience in the aggregate, including more than ten years with the Company, in various information technology roles. Our audit committee is responsible for overseeing cybersecurity risks, and our management team reports to our audit committee on the Company's cybersecurity program, current cybersecurity projects and industry trends and efforts to mitigate cybersecurity risk on at least a semi-annual basis.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: PACCAR's Security Risk Council, which includes the Company's Management and PACCAR's Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the PACCAR Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the PACCAR Board of PACCAR Financial Corp. (Millions of Dollars)

companyName: PACCAR FINANCIAL CORP


text: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes, and risk assessment related to information security and data protection, including data privacy and network security (our Cybersecurity Program). The VP of IT has served in various roles in information technology and information security, along with other members of the IT department, and holds relevant and applicable certifications. The VP of IT reports directly to the Company's Chief Executive Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our board of directors, and the audit committee of our board of directors.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our business.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Director of Information Technology on the status of our cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: 908 Devices Inc.

ticker: MASS


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Arcellx, Inc.

ticker: ACLX


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities.

companyName: authID Inc.

ticker: AUID


text: We face various cybersecurity risks, including, but not limited to, risks related to unauthorized access, misuse, data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity and information security threats through our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our broader Enterprise Risk Management ("ERM") program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. This integrated approach helps ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's operational, financial and strategic risks, assisting the Company in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: COCA COLA CO

ticker: KO


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Director of Cyber Security is our incident response team leader. In this position, our Director of Cyber Security oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Director of Cyber Security has nearly two decades of experience in cybersecurity management and policy, achieved through job training, college education, and work in security and alignment of information technology solutions.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: The management team is required to update the Board immediately once a material breach occurs. The Board is provided timely updates until the incident is considered resolved.

companyName: FORWARD AIR CORP

ticker: FWRD


text: The Company has information technology security practices to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: • cybersecurity controls embedded in the Company's information technology systems; • implementation of changes to address potential threats and vulnerabilities of the Company's information technology systems; • incident response programs, including proactive simulations, to identify and manage cybersecurity threats, risks or incidents; • participation in industry forums and collaboration with peers; • security awareness and data protection training for applicable employees; and • engaging third party services and tools to periodically assess and/or monitor cybersecurity threat environment and the company's cybersecurity posture.

companyName: Quanex Building Products CORP

ticker: NX


text: In conjunction with the FAIR assessment, the Company uses the MITRE Attack framework to identify the various exploitation techniques and tactics used by the most likely threat actors. This framework informs the risk management process with valuable insight into some of the most common, or likely, cyber attacks the Company should address.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: BFIM is responsible for identifying, assessing, and managing the Assignor Limited Partner's material risks from cybersecurity threats. BFIM relies on ORIX USA and the ORIX USA information and security team, including the ORIX USA CIO, to provide us with a comprehensive cybersecurity risk management program.

companyName: BCTC IV ASSIGNOR CORP


text: Role of Management Management is responsible for managing risks and informing the Board of the Company's material near- and long-term risks and risk management strategies. Management presents the Company's risk assessment, which includes its cybersecurity risks, to the Audit Committee on at least an annual basis.

companyName: IMAX CORP

ticker: IMAX


text: cybersecurity threats are evaluated throughout the year by our around-the-clock security operations center, utilizing a variety of third-party subscription and threat intelligence data sources, and data collected via internal monitoring and scanning processes;

companyName: TE Connectivity plc

ticker: TEL


text: Impact of Cyber Risk on our Business We face a number of cybersecurity risks in connection with our business. We continue to invest in the security and strength of our networks and to enhance our internal controls and processes, which are designed to help protect our systems, infrastructure, and data. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the December 2022 cybersecurity incident, have not materially affected our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, "Risk Factors."

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Empire Limited acknowledges the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: Synergy Empire Ltd


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures. The results of such assessments are reported to the audit committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: Julie A. McAlindon, age 56, is Senior Vice President, Regions and Chief Supply Chain Officer. Ms. McAlindon has responsibility for overseeing global supply chain, sourcing and procurement, and regional leadership outside of North America. Ms. McAlindon also leads the transformation of Eastman, building the capabilities and culture required to support Eastman's strategy. Prior to this role, Ms. McAlindon was Chief Procurement Officer and Vice President, Transformation. Ms. McAlindon joined Eastman in 2016. Before joining Eastman, Ms. McAlindon was with Avient Corporation as senior vice president, designed structures and solutions; and vice president of marketing. Prior to that, Ms. McAlindon's work experience includes a variety of leadership positions with The Dow Chemical Company. Ms. McAlindon was appointed to her current position effective June 2021.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: HUMBL, INC.

ticker: HMBL


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication. Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on the firm's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors–Technology Risks" for more information on how a material cybersecurity incident may impact us.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems we control from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including the public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company maintains several plans designed to prepare the Salesforce Security Response Center (SSRC) with the proper training, processes and capabilities needed to effectively respond to incidents.

companyName: Salesforce, Inc.

ticker: CRM


text: Our CEO is the liaison between the ISRM Committee and the Board and is responsible for communication between the two groups.

companyName: AdTheorent Holding Company, Inc.


text: Our IT Security Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the IRT. The IRT works with the IT department and external cybersecurity experts to help us mitigate and remediate cybersecurity incidents. In addition, our IT Security Incident Response Plan includes reporting to the board of directors for certain cybersecurity incidents.

companyName: Cidara Therapeutics, Inc.


text: We operate in the logistics and crude oil distribution sector, which is subject to various cybersecurity risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, operations, cash flows or reputation.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: The Board's Audit Committee oversees our global cybersecurity risk environment, strategy, and priorities. Our CIO, together with other senior leaders, regularly reviews the Company's global information technology (IT) system with the Committee, including reports on risks from cybersecurity threats and the Company's processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In 2023, this review included the CIO's assessment of our IT and cybersecurity capabilities and continuous improvement plan. Our CIO's report to the Audit Committee is provided annually or, if the circumstances warrant, more frequently. In addition, the Board receives periodic reports from the Audit Committee and our CIO relating to risks from cybersecurity threats.

companyName: ChampionX Corp


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third -party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: iShares Bitcoin Trust ETF

ticker: IBIT


text: Cybersecurity risk is an important and continuously evolving focus for us, the Adviser, J.P. Morgan, and its affiliates. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Adviser's security efforts are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradation of service, sabotaging systems or other damage.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: The audit committee of the board of directors receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. These quarterly reports include summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: NETSTREIT Corp.

ticker: NTST


text: Our CIDO has served in various roles in IT and information security for over 20. She holds an undergraduate degree in information management and technology. Our Director of Cybersecurity has served in various roles in IT and information security for over 18 years, including in the military and the healthcare and retail industries.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Management of the Company, in coordination with the Investment Adviser, actively monitors cybersecurity incident prevention, detection, mitigation, and remediation efforts. The CCO of the Company and the CISO of the Investment Adviser jointly lead the incident response process and escalate incidents to the Board in accordance with established escalation protocols, typically within 48 hours after determining that a cybersecurity incident reaches materiality thresholds requiring Board notification.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2024). The CISO's update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key's compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key's Deputy CISO, also report annually to the Technology Committee to obtain approval on Key's Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.

companyName: KEYCORP /NEW/

ticker: KEY


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents a key component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EASTERN CO

ticker: EML


text: As part of our ongoing information security program, we utilize periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels must navigate complex incident scenarios to help determine our level of preparedness for various cybersecurity incidents.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: In the ordinary course of business, CSB relies on electronic communications and information systems to conduct its operations and to store sensitive data. CSB employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. CSB employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. CSB Places a high priority and focus on securing the confidential information it receives and stores about its customers and associates and providing highly available systems.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Information Security team monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, assessing and prioritizing risks, employing various tools and techniques, including vulnerability scanning and penetration testing. Based on the risk assessment, appropriate security measures are implemented. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.

companyName: SYNAPTICS Inc

ticker: SYNA


text: The CISO, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan. Through the ongoing communications from these teams, the CISO and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: The Company requires its employees and applicable contractors to take a yearly cyber training courses and its employees and applicable contractors are also required to sign confidentiality agreements for purposes including ensuring cybersecurity. We and our MSP/MSSP have established an incident response plan to assist with responding to cybersecurity incidents. The incident response plan includes our approach to identification, escalation, and restoration from incidents, such as engaging or informing third-party experts, law enforcement, and members of the Board of Directors, as appropriate.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: We conduct periodic vulnerability assessments based on our use of technology, third party vendor relationships and reported changes in cybercrime methodologies, and in response to any attempted cyber incident, among other circumstances.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: The Board administers its risk oversight function directly and through committees and our Board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy are overseen by the audit committee. At each regular meeting of the audit committee of our Board, management provides reports relating to existing and emerging risk at our companies, including, as appropriate, cyber and data security risks, and any security incidents. At least annually (or more frequently in the event of material changes to the Company) the update to the audit committee includes a summary of management's complete reassessment of the Company's risk and control environment identified through our ERM program. Our audit committee chairman reports on these discussions to our Board on a quarterly basis.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: Information Security Management. To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank's Information Security Program. The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third-party vendor management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Company engages qualified third-party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.

companyName: BankFinancial CORP


text: Our risk-based assessment and management of material risks from cybersecurity threats are integrated into NetScout's overall risk management processes. Cybersecurity risks are addressed as a component of NetScout's enterprise risk management program and our enterprise risk management processes include an Enterprise Risk Management Steering Committee ("Steering Committee"), led by the CCO and including members of management, that meets quarterly and considers ways to mitigate cybersecurity threats that are more likely to lead to a material impact to our business. The Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and provides a risk register report to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program pursuant to the audit committee's charter. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities from our Senior Director of IT. The audit committee may update the full board of directors on matters relating to cybersecurity risk management as needed.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Our corporate information security team, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, security operations (as a second line of defense) and cyber threat detection and response. The current CISO has ten years' experience in cybersecurity and 35 years as an information technology professional. Given that our CISO has more than 25 years at the Company in multiple positions, he helped incubate and grow our corporate information security team into what it is today. Our information security management philosophy is one of cyber risk prevention and we have the ultimate goal of preventing cyber incidents. Simultaneously, our information security team focuses on increasing our system resilience to minimize data breach (or other compromise) business impact should an incident occur. Cybersecurity is not the sole responsibility of our information security team. Our Security team meets with business leaders regularly and works closely with internal departments to keep security at the forefront. Our employees and vendors also play a role in our company's cybersecurity efforts. Through our cybersecurity awareness training and other team training we are fostering a culture that all employees and vendors have a role in our cybersecurity defenses.

companyName: Altair Engineering Inc.


text: Our Information Technology Security Team, under the oversight of our Senior Vice President and Chief Technology Officer and the leadership of our VP of IT Infrastructure and Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Information Technology Security Team manages and continually enhances a robust enterprise security structure with the ultimate goal of minimizing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our Information Technology Security Team possesses decades of experience in navigating cybersecurity threats and mitigating associated risks as a result of holding similar positions at other large companies. Most members of the team hold degrees in cybersecurity and/or related disciplines, have cybersecurity certifications such as Certified Information Systems Security Professional (CISSP) and/or periodically attend various cyber-focused conferences and training programs. Specifically, our Senior Vice President and Chief Technology Officer and our VP of IT Infrastructure and Security combined have over 30 years of technology and cybersecurity experience. The team provides regular reports to senior management and affected departments on various cybersecurity threats, assessments and findings.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: We utilize an in-depth layered approach to security. This allows us to respond and mitigate cybersecurity risks, underscoring our commitment to the confidentiality, integrity, and availability of our data and systems. The Company has processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. Our strategy includes the deployment of advanced security products and penetration testing to identify and mitigate vulnerabilities by continuous vulnerability scanning and monitoring by both internal and external teams. This approach is bolstered by backup and recovery protocols, including data resilience, email security measures and endpoint detection and response systems to thwart malicious activities.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: While our board of directors has oversight responsibility for risk management generally, the Audit Committee is specifically responsible for overseeing our cybersecurity risk management program to ensure cybersecurity risks are identified, assessed, managed, and monitored. Our Executive Director, Information Technology, who has over 15 years of experience in the cybersecurity field and regularly attends cybersecurity conferences and actively implements new technologies to keep our systems up to date and secure, provides periodic updates to the Audit Committee in this regard, and details our cybersecurity program supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents, including those associated with our third-party service providers. The Audit Committee is responsible for updating our full board of directors on material risks from cybersecurity incidents or threats.

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer ("CIO") who has over 30 years of relevant work experience. Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a manner designed to mitigate cybersecurity risks. Our CIO reports on a quarterly basis to Huron's internal Information Security Management System ("ISMS") Committee, which has the primary responsibility for assessing and managing material cybersecurity risks. The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders, reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Cybersecurity Risks To date, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding cybersecurity risks, see " Item 1A. Risk Factors ".

companyName: VICI PROPERTIES INC.

ticker: VICI


text: The Chief Security Office develops Deutsche Bank Group's security strategy and oversees its implementation and operationalization globally via the organizational set-up, governance, and implemented security policies. The security strategy is reviewed continually to address changes in the threat landscape, technology, the regulatory environment, the overall corporate and IT strategy, and other internal and external parameters.

companyName: RREEF Property Trust, Inc.


text: In the event of a cybersecurity incident, our management will report to the board of directors and provide updates on its plan for addressing and mitigating any risks associated with such incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have a material adverse effect on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: WinVest Acquisition Corp.

ticker: WINV


text: The Audit Committee has responsibility for the oversight of the Company's risk management program, including technology and cybersecurity risks facing the Company. The audit committee receives briefings from management and the executive director of information technology about cybersecurity risk management and the overall technology and cybersecurity environment.

companyName: VALUE LINE INC

ticker: VALU


text: Additionally, the Cybersecurity Risk Committee holds periodic Cybersecurity Governance Forums, in which detailed cybersecurity program updates and metrics are reported.

companyName: Drilling Tools International Corp

ticker: DTI


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's Risk Management program and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's Risk Management program, including oversight of cybersecurity risk and risk management, to the Audit & Risk Committee of the Board. The Audit & Risk Committee receives regular updates on the cybersecurity program, including cybersecurity risks and incidents through direct interaction with the Chief Technology Officer, the Chief Information Security Officer and the Chief Risk Management Officer. Additionally, the Board of Directors also receives periodic updates regarding cybersecurity risks and the cybersecurity program, as well as training at least annually on the Director's role in managing cybersecurity risks.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Trinseo faces risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, financial condition, cash flows or reputation. Trinseo has experienced, and will continue to experience, cyber incidents in the normal course of our business. Trinseo has not experienced any material cybersecurity incidents or incurred material expenses related to cybersecurity incidents. As of the date of this report, we are not aware of any material risks from cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, financial condition or reputation. See Item 1A Risk Factors for a discussion of cybersecurity risks.

companyName: Trinseo PLC

ticker: TSEOF


text: Our Board of Directors evaluates our readiness to manage cybersecurity threats, receiving regular updates from the SVP of Information Technology, General Counsel, and CEO regarding any materially impactful cybersecurity risks.

companyName: Microvast Holdings, Inc.

ticker: MVST