text: We utilize certain third-party service providers to perform a variety of functions, such as to outsource certain business critical functions, to augment staff for after-hours support, to help track chain of custody for physical PCI devices for our shops, application providers, hosting companies, distributors, supply chain resources, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology, corporate productivity services, and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, for certain service providers, our vendor management process may include reviewing the cybersecurity practices of certain providers, contractually imposing obligations on certain providers related to the services they provide and/or the information they process, conducting security assessments, requiring providers to complete written questionnaires regarding their services and data handling practices, conducting periodic re-assessments during their engagement, using a third party vendor management security company to provide certain ongoing monitoring, or annually collect certain information security-related compliance documentation and reports.

companyName: Dutch Bros Inc.

ticker: BROS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) our Cybersecurity Team works with our management team (comprised of our Chief Legal Officer, Chief Financial Officer and Chief Risk Officer) to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Cybersecurity Team and management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the cybersecurity committee chairperson of the board of directors who may then notify the cybersecurity committee and board of directors (as appropriate), to further evaluate our overall enterprise risk.

companyName: NETGEAR, INC.

ticker: NTGR

secItem: Item 1C


text: Third-Party Cyber Risk Management Our Third Party Cyber Risk Management Plan ensures that due diligence is carried out on third parties prior to and during engagement. Prior to engagement, third parties are assessed using a questionnaire that covers all areas of security including cyber risk and external documentation is requested such as SOC2 T2, penetration testing, and ISO 27001 certification and scope. We include security and privacy clauses within our third party contracts where applicable, which cover the implementation of security controls and self reporting. During engagement, third parties are regularly reviewed, at least annually, to ensure that cyber risks are evaluated and assessed on a continual basis.

companyName: EGAIN Corp

ticker: EGAN


text: The Chief Financial Officer oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.

companyName: DIH HOLDING US, INC.


text: Under our ERM program, we conduct an annual enterprise risk assessment, which produces an enterprise risk scorecard. Cybersecurity is one of nine primary risk categories identified within the scorecard. The cybersecurity risk rating is based on a detailed enterprise security risk assessment performed by the Security team. The enterprise risk scorecard is reviewed with management and the Board of Directors on an annual basis.

companyName: EQUIFAX INC

ticker: EFX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, in areas such as legal, compliance, strategic, operational and financial risk.

companyName: ARDELYX, INC.

ticker: ARDX


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This Playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of the Board of Directors. These escalation provisions, together with Lumen's Disclosure Controls and Procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.

companyName: QWEST CORP

ticker: CTBB


text: We face a number of cybersecurity risks in connection with our business and have, from time to time, experienced external threats seeking to compromise the security, confidentiality, or integrity of our data and systems, including malware and computer virus attacks. However, as of the date of this report, Davey Tree is not aware of any such risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: DAVEY TREE EXPERT CO


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our senior leadership for overseeing the company's cybersecurity risk management, including the Vice President of Information Technology, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Such members of our senior leadership also report to the Board at least annually on cybersecurity matters, including information security and cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: We strive to align BD Information Security policies and procedures with industry best practices, including the NIST Cybersecurity Framework 2.0, International Organization for Standardization ("ISO")/International Electrotechnical Commission (IEC) 27001:2022 standards for information security, Underwriters Laboratories ("UL") 2900-1 Cybersecurity Standard for Medical Devices, and U.S. Food and Drug Administration's pre-market and post-market guidance for cybersecurity in medical devices as required by law under Section 524B of the Federal Food, Drug, and Cosmetic Act (FD&C Act). The Healthcare Sector Coordinating Council (HSCC) Joint Security Plan (JSP) 2.0 is a recognized industry standard that informs how we manage the security of our products. These policies and procedures establish processes for handling data, assets, systems and other technology resources to help protect BD products, manufacturing and distribution OT, enterprise IT and BD data. In 2022, BD achieved ISO/IEC 27001:2022 certification at the enterprise level, demonstrating that BD's Information Security Management System (ISMS) conforms to internationally recognized cybersecurity standards. In 2025, BD engaged a third-party auditor to complete its third enterprise-level annual surveillance audit for ISO 27001, which determined that BD continues to meet these rigorous standards.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 25 years of relevant work experience and holds the Certified Information Systems Security Professional certification, reports to the CIO. The CISO is responsible for assessing, monitoring and advising the Company's businesses, management and the Board of Directors ("Board") on the Company's risks from cybersecurity threats; implementing cybersecurity strategy, programs and processes across our enterprise and connected products and services; reviewing the risk management measures implemented by the Company to identify and mitigate cybersecurity risks; and overseeing the maintenance and deployment of the Cybersecurity Incident Response Plan.

companyName: Xylem Inc.

ticker: XYL


text: Oversee Third-party Risk We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented processes designed to manage the cybersecurity risks associated with its use of third-party service providers.

companyName: Allegion plc

ticker: ALLE


text: Markel participates in the Financial Services Information Sharing and Analysis Center to share information about the latest cyber threats and preparedness measures. Markel also shares threat intelligence information with other partners. Markel has a cybersecurity incident response plan, as well as a crisis management plan, that cover cyber events, including a process for determining the materiality of cyber events that includes evaluation by a cross functional crisis management group including security, information technology, finance, legal and business and escalation to Markel Group senior management as warranted by the severity of the situation. An internal team engages in tabletop exercises several times each year to enhance preparedness for such situations.

companyName: MARKEL GROUP INC.

ticker: MKL


text: We have not experienced any material information security breaches in the last three years, nor are we aware of any cybersecurity risks that are reasonably likely to have a material adverse affect on us. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. For additional information about our cybersecurity risks, please refer to "Item 1A. Risk Factors - We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, or financial loss.".

companyName: CIVITAS RESOURCES, INC.


text: Our Board of Directors, in coordination with the Audit Committee, oversees our management of cybersecurity risk, including our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee directly oversees our cybersecurity program. The Audit Committee receives quarterly cybersecurity updates from management, including risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur quarterly, or more frequently as determined to be necessary or advisable.

companyName: Match Group, Inc.

ticker: MTCH


text: Our CISO has approximately 21 years of experience in the cybersecurity industry. She is responsible for developing, coordinating and overseeing our cybersecurity strategy, policy, program and solutions, and for providing cybersecurity guidance to key management and internal company oversight bodies. Our CISO manages our cybersecurity organization, which covers all regions in which we operate and which is staffed with employees dedicated full-time to cybersecurity. Our CISO reports directly to our Chief Information Officer ("CIO") and reports on cybersecurity at least quarterly to senior management and semi-annually to the full board of directors, or more often as needed.

companyName: Sylvamo Corp

ticker: SLVM


text: As part of its cybersecurity program, the Company deploys comprehensive measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, physical security measures, multi-factor authentication, and other tools to detect data exfiltration. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents by assessing current threat intelligence from various sources, including but not limited to, certain key vendors, the United States Cybersecurity & Infrastructure Security Agency ("CISA"), and the open source threat intelligence community via open-source threat intelligence databases. Furthermore, we conduct periodic table top exercises, vulnerability and security testing, and "lessons learned" reviews from internal and industry related cybersecurity incidents. We have a process to report material results of such testing and assessments to the Board and our Audit Committee, and periodically make adjustments to our cybersecurity program based on these exercises and reviews. The Company engages third parties to conduct certain aspects of such testing and to assist with the Managed Detection and Response ("MDR") of security events as well as the collection and reporting of data for cybersecurity key performance indicators (i.e., KPIs). The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective through a vendor management program, including annual reviews of key vendors' adherence to cybersecurity compliance, the monitoring of alerts from CISA, as well as open-source threat intelligence.

companyName: Janus International Group, Inc.

ticker: JBI


text: WEC Energy Group's CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. WEC Energy Group's CAO has 24 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in WEC Energy Group's IT/OT cybersecurity, data security, and physical security environment and risk profile.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Our cybersecurity risk management program utilizes information and guidance derived from industry-recognized frameworks, including the International Organization for Standardization (ISO) 27001 Framework and the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-53 and NIST 811-171 publications. While we have based our cybersecurity risk management program on these frameworks, we have not obtained these specific certifications to date. Our cybersecurity risk management program is overseen by our Chief Information Officer ("CIO") and/or our First Vice President of Information Security ("FVPIS") and reviewed annually.

companyName: PRICESMART INC

ticker: PSMT


text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program and evaluated against such Framework. Our information security and ERM teams coordinate to regularly review and assess these risks using a wide range of tools and services.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our information security function and management team is led by our Chief Information Officer, who has approximately 26 years of experience in the information technology area and reports to our Chief Financial Officer and our Director of Infrastructure and Controls. Our Director of Infrastructure and Controls has approximately 20 years of experience in the information technology area.

companyName: Simply Good Foods Co

ticker: SMPL


text: We understand the importance of protecting data. Our Privacy Policy defines "personal data" and, among other things, explains its coverage, how personal data is collected and stored, and a user's rights to restrict its usage or opt out. Our privacy policies are updated annually and are conspicuously displayed on all applicable digital properties. For more information, please see the Privacy Policy on our website.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: We face various cybersecurity threats, including unauthorized access, malware, ransomware, and phishing attacks. These threats could compromise the security of our information systems and the data we store and process. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: The Audit Committee reviews our cybersecurity program on a quarterly basis, including through review of a quarterly enterprise risk management report, and periodically convenes special meetings to conduct deeper preparedness, enterprise risk and business continuity reviews. These special meetings are open to the full Board to attend. In addition, the full Board receives a regular cybersecurity update at least once annually. All of these meetings include our Chief Digital and Technology Officer ("CDTO") and Chief Information Security Officer ("CISO").

companyName: RALPH LAUREN CORP

ticker: RL


text: While our Board maintains responsibility for oversight of all areas of risk management, it relies on our Audit Committee to address significant financial risk exposure we may face and the steps management has taken to monitor, control and report such exposures. These risks are further reported to the full Board, as appropriate.

companyName: REGAL REXNORD CORP

ticker: RRX


text: The Audit Committee is responsible for overseeing the Company's guidelines and policies with respect to risk assessment and risk management to assess and manage the Company's exposure to enterprise risk. The Audit Committee periodically reviews and discusses with management the Company's policies with respect to risk assessment and risk management, including but not limited to cybersecurity and enterprise risk, and steps management has taken to monitor and control such exposures.

companyName: Innventure, Inc.

ticker: INV


text: We deploy quarterly cybersecurity training for employees and consider this a critical step in safeguarding the Company's data and assets. The training provides employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training techniques to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and includes interactive modules covering various areas, including insider attacks, phishing and email attacks, preventing malware attacks, data protection, data handling, passwords, cloud and internet security, and cybersecurity fundamentals for mobile devices.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: The SVP, Chief Information Officer researches the latest technologies and trends used by cybercriminals through publications, conferences and discussions with peers. Cyber threats identified are communicated to all members of the Company via email to promote awareness and assist with protecting us from potential risks or breaches. All employees are required to undergo regular security awareness trainings and we routinely conduct internal phishing and other exercises to gauge the effectiveness of the trainings and assess the need for continued education and/or areas where improvement may be needed.

companyName: Urban Edge Properties

ticker: UE


text: The SGC is comprised of members of our executive leadership team, including the Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Administrative Officer, Chief Information Officer ("CIO") and CISO. The CISO reports to the SGC on a regular basis, and informs the committee of critical risks that could potentially affect our information security and cybersecurity posture, as well as regulatory compliance; the status of key projects designed to evolve our information security programs; and any significant cybersecurity issues, incidents and patterns of events. The SGC has the authority to (i) investigate any matter brought to its attention that may impact our ability to adequately protect our information assets and (ii) to involve its members, the Board, other steering committees, government agencies and law enforcement, as it deems appropriate to respond to and remediate such matters. The CISO provides updates to the SGC during the course of significant cybersecurity incidents and in parallel, response teams partner with our IT and legal teams, law enforcement and others as needed to triage and remediate such incidents. Following such events, we implement changes as appropriate to improve our risk mitigation and remediation capabilities as cyber threats evolve.

companyName: QuidelOrtho Corp

ticker: QDEL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.

companyName: CORNING INC /NY

ticker: GLW


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Meetings of our board of directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.

companyName: Sintx Technologies, Inc.

ticker: SINT


text: The Program leverages a blend of automated systems, manual operations, and external evaluations to proactively identify and mitigate potential cybersecurity threats. Key components of the Program include Tredegar's Cybersecurity Incident Response Plan and Cyber Crisis Management Plan. These plans encompass a strategic approach that includes: (i) detection of threats, thorough analysis of cybersecurity incidents to determine whether timely notification to Tredegar's Board of Directors ("Board") is necessary; (ii) containment of incidents; (iii) eradication or mitigation of threats; (iv) recovery processes; and (v) a comprehensive post-incident review.

companyName: TREDEGAR CORP

ticker: TG


text: Risk Management & Strategy. AVD has adopted a comprehensive set of controls and processes to encourage a high level of awareness of, and responsiveness to, cybersecurity threats. The foundational document outlining the program is embodied in Registrant's Enterprise Information Security Policy (the "REIS Policy"). The REIS Policy establishes a framework for the continuous monitoring of its computing resources, the maintenance and reporting of audit logs and the assessment of events that could form the basis of a threat. In addition, the REIS Policy sets forth requirements for employee awareness training, user authentication, software usage restrictions and boundary protection, among other things. The policy also establishes an incident response plan, including back-up hosting, alternate processing and system recovery, along with assignment of responsibility and resources for those activities. Within the exhibit of the REIS Policy, management either working alone or, in case of greater complexity, with consultants, will assess an incident or series of incidents for materiality, taking into account the nature of the incident,, duration, the nature of data compromised, and the nature of damages (including with respect to reputational, third party, share price, and business interruption) and all within the context of the Company's financial performance during the affected reporting period(s).

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: Our Principal Security Engineer ("PSE") is responsible for the day-to-day assessment and management of our material cybersecurity risks. Since November 2021 until May 2025, the Principal Security Engineer (the "PSE-1") that served in this role had more than 18 years of experience in various information technology, cybersecurity and systems engineering roles. PSE-1's previous experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software teams which were acquired by Fortune 50 enterprises. PSE-1 also had expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The Principal Security Engineer holds a master's degree in physics and systems engineering. Since May 2025, the Company's Manager of IT ("PSE-2") has assumed the responsibilities of the Principal Security Engineer role. With more than 18 years of experience in information technology and over 12 years in IT management across technology-driven and interactive entertainment organizations, PSE-2 has frequently led both IT operations and cybersecurity initiatives, often as the sole technical lead. Responsibilities have included securing infrastructure, implementing security controls, and supporting secure business operations.

companyName: Skillz Inc.

ticker: SKLZ


text: The Company's Chief Executive Officer and Chief Information Officer work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy will include reporting certain cybersecurity incidents to the Audit Committee of the board of directors.

companyName: SunPower Inc.

ticker: SPWR


text: Our risk mitigation strategy focuses on measures to prevent, detect, and respond to cybersecurity incidents. The primary components of our risk mitigation strategy include: • Security Controls: We maintain a comprehensive set of controls aligned with industry standards such as the National Institute of Standards and Technology ("NIST") and the International Organization of Standards ("ISO") 27001 to protect our systems, networks, and data. • Incident Response Plan: We have a well-defined incident response plan that outlines roles, responsibilities, and procedures for handling cybersecurity incidents. • Employee Training and Awareness: We have training programs to ensure that our employees understand their role in maintaining a secure environment and recognize potential threats. • Third-Party Risk Assessment and Management: We assess and manage cybersecurity risks associated with our vendors, partners, and service providers.

companyName: ICF International, Inc.

ticker: ICFI


text: The Company utilizes an affiliated company of Pacific Trail ("IT Provider"), which is a provider of financial services to numerous affiliates of Pacific Trail, which operate in the real estate and financial services industries for its accounting, accounts payable, treasury and related Information Technology ("IT") and data processing functions. The Company's financial systems and related controls, procedures, risk management, and including IT systems is integrated with that of the affiliated companies (together the "Affiliated Group").

companyName: KAANAPALI LAND LLC

ticker: KANP


text: As part of that risk management process, members of our executive team identify, assess, and evaluate risks impacting our operations, including those risks related to cybersecurity, and raise them for discussion with other executives, and where it is determined to be appropriate, issues are also raised to the Board for consideration.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Our cybersecurity leadership team ("CSLT"), which includes leaders accountable for security operations, incident response, risk and compliance, data security, application security, digital solutions security, vulnerability management and operational technology security, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall CSRM program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Information security personnel maintain a variety of technical and managerial security certifications and have broad security experience in manufacturing, finance, software and IT environments.

companyName: Avery Dennison Corp

ticker: AVY


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not experienced any incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: NOVANTA INC

ticker: NOVT


text: Current Cybersecurity events In late May 2023, we experienced a ransomware attack relating to certain systems on our network (the "Cybersecurity Incident"). We promptly initiated an investigation, engaged the services of cyber-security experts and outside advisors and worked with appropriate law enforcement authorities to contain, assess and remediate the Cybersecurity Incident.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: Furthermore, in 2023, we engaged a third party to conduct a Cyber Risk Quantification assessment. This assessment focused on estimating the likelihood and potential financial impact of a widespread ransomware attack within our network. It involved a thorough evaluation of both our current and planned cybersecurity capabilities.

companyName: MARATHON OIL CORP


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Protection of electronically stored data is costly and if Starz's data is compromised in spite of this protection, it may incur additional costs, lost opportunities and damage to its reputation."

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: We are constantly assessing our environment for cybersecurity threats, and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. At the time of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. See Part I, Item 1A. Risk Factors – "Evolving data privacy requirements (in particular, compliance with applicable federal, state and foreign laws relating to handling of personal information about individuals) could increase our costs, and any significant data privacy incident could disrupt our operations, harm our reputation, expose us to legal risks and otherwise materially adversely affect our business, results of operations and financial condition."

companyName: AMERICAN AIRLINES, INC.


text: During the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see Item 1A "Risk Factors" in this Annual Report.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: We expect that cybersecurity will become an important part of our risk management processes and an area of focus for our Board of Directors and management. We expect that our Board of Directors will be responsible for the oversight of risks from cybersecurity threats. We expect our senior management will provide our Board of Directors updates on a quarterly basis regarding matters of cybersecurity. This is expected to include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. We expect that our Board members will also engage in periodic conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: The Bank's board of directors has approved the management level Operations Committee, which focuses on business impact, and the Enterprise Risk Management Committee ("ERM Committee"), which also focuses on business impact and provides oversight and governance of the information security program, and the board level Strategic Technology Oversight Committee ("STOC"), which focuses on technology impact and provides oversight and governance of the technology program. The Operations Committee is chaired by the Chief Operating Officer and includes the Chief Information Security Officer and Chief Information Officer and other key departmental managers from throughout the Company. This committee generally meets bi-weekly to discuss various operational strategy and issues, including information technology and information security policies, practices, controls, and mitigation and prevention efforts.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of our cybersecurity risk management program. The Audit Committee receives quarterly reports from management on cybersecurity risks, risk assessment and risk management, and discusses those matters with management. In addition, management updates the Audit Committee on cybersecurity incidents. The Audit Committee also receives and discusses quarterly reports from management on the effectiveness of our information technology security controls.

companyName: Stagwell Inc

ticker: STGW


text: Management has also developed procedures to assess the operations and internal controls of material service providers through the use of questionnaires, reviews of available policy statements, and evaluation of System and Organization Controls assurance reports, which are assessed in the aggregate to determine if the service providers have adequately addressed the risks of cybersecurity threats within their operations. The overall assessment includes an evaluation of a service provider's breach notification policies and procedures and any reported cybersecurity incidents. Management is not aware of any cybersecurity incidents at any of its service providers that have materially affected or are reasonably likely to materially affect the Partnership's operations.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Like other lenders, the banks and several of our operating subsidiaries use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates, among other things, reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information (including personal information) between affiliates, and using affiliate data for marketing purposes. Similar state laws and regulations may impose additional requirements on us, the banks and our operating subsidiaries.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Additionally, we maintain an Incident Response Plan that provides established procedures for timely reporting and escalation of significant cybersecurity incidents. Our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. The Incident Response Plan is coordinated through the Vice President of Information Technology ("VP of IT") and key members of executive management who are responsible for escalation as part of the Plan.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Our cybersecurity risk management and strategy activities are overseen by executive management, made up of the IT Steering Committee and Chief Information Officer. Our Chief Information Officer has over 25 years of experience in information technology and security as well as extensive experience working in and leading our information systems and technology function. The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee on any appropriate items.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: The Director of Information Technology, along with members of management, inform the Audit Committee on cybersecurity risks by providing periodic updates regarding (i) Status of ongoing cybersecurity initiatives and strategies, (ii) The overall state of the Company's security program and potential exposure to risks, and (iii) Incident reports and learning from any cybersecurity events. Further, the Director of Information Technology maintains an open dialog regarding any significant developments in cybersecurity risks, ensuring the Audit Committee's oversight is proactive and responsive. In addition to periodic updates to the Audit Committee, the Director of Information technology, in his capacity, regularly informs the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") regarding matters related to cybersecurity risks and incidents. This ensures the highest level of management are informed of potential risks associated with cybersecurity that could have a material and adverse effect on the Company.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: We face a multitude of cybersecurity threats from a range of adversaries. Our vendors, clients, distributors and other third parties with whom we work face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business, operations, financial condition and results of operations.

companyName: ASSURANT, INC.

ticker: AIZ


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" and "Risk Factors – Risks Related to Government Regulation" in this annual report on Form 10-K.

companyName: American Well Corp

ticker: AMWL


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Members of our audit committee receive updates on a regular basis from senior management, including leaders from our IT and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team ("SMT") and our Tech Oversight Committee. Our Tech Oversight Committee includes members of our Board and management. Our CISO has served in this capacity for more than a decade and maintains multiple certifications issued by the Information Systems Audit and Control Association ("ISACA") and the SANS Institute. As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy ("ICSPP") and Information & Cyber Security Incident Response Policy ("ICSIRP").

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: See "Risk Factors – Risks Related to Information Technology, Intellectual Property and Data Privacy and Security" - "A real or perceived bug, defect, security vulnerability, error, or other performance failure involving our platform, products or solutions could cause us to lose revenue, damage our reputation, and expose us to liability." and "If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers' data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities."

companyName: KALTURA INC

ticker: KLTR


text: Our information security function is supported by members of our legal team and a third party service provider, which helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting vulnerability assessments to identify vulnerabilities; and analyzing external threat intelligence feeds.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Primary responsibility for assessing and managing risks from cybersecurity threats resides with our management team, including a Chief Information Officer who has nearly 30 years of information technology experience including leadership roles at multiple large, global and/or publicly-traded companies, and a Chief Information Security Officer who has over 30 years of experience in cybersecurity with large international publicly-traded companies and who holds a Certified Information Systems Security Professional (CISSP) certification. These individuals, together with others on their teams, are informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management policies, processes and operations discussed above. They regularly report to and consult with the executive leadership team on such matters.

companyName: Celanese Corp

ticker: CE


text: While our full Board has overall responsibility for risk oversight and is currently overseeing our business continuity, regulatory and compliance risks, it is supported in this function by our Audit Committee, Compensation Committee and NCG Committee. Our Audit Committee periodically reviews our cybersecurity, information technology, data protection, privacy and compliance risk management, as well as performs other risk oversight functions. Through its regular meetings with management, including the accounting and finance, legal, internal audit, regulatory compliance and information technology and security functions, the Audit Committee reviews and discusses our cybersecurity risk management practices and policies and periodically updates the Board or relevant members or committees thereof, about any material risks and the appropriate mitigating factors.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Fusion Pharmaceuticals Inc.


text: Third-Party Engagement Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, to periodically evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the intention of keeping our cybersecurity strategies and processes at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. The cybersecurity program also involves performance of tabletop exercises to test our incident response plan.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, there is no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations or financial condition in the future. See Part I – Item 1A – Risk Factors – "We regularly experience cyberattacks and expect they will continue in the future. We may not be able to adequately protect our information systems, including the data we collect, which could subject us to, among other things, liability, damage to our reputation, and other financial impacts. Our efforts to implement robust security measures and comply with applicable data protection laws are costly and time-consuming and they cannot provide absolute security against cyberattacks, security breaches or unauthorized access."

companyName: WEX Inc.

ticker: WEX


text: Management's Role Managing Risk The Director of Internal Audit and the Chief Financial Officer ("CFO") play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to the Board of Directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board of Directors, Director of Internal Audit, Director of Information Technology and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board of Directors' oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Partnership. The Board of Directors conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our information technology ("IT") function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed extended detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure. The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.

companyName: STONERIDGE INC

ticker: SRI


text: We have experienced targeted cybersecurity threats and incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. To date, no cybersecurity incident, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A "Risk Factors".

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: Cyber Risk Oversight Committee Additionally, in 2014 the board of directors established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies. The CyROC is chaired by the Company's CIO and is comprised of members such as the chief financial officer, information technology leaders, internal auditors, and other leaders from the Company's business segments.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third -party interactions.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Vendor Risk Oversight Given the risks associated with using third-party service providers, we have developed processes to oversee and manage these risks. We aim to start the assessment right from the vendor onboarding stage, by conducting security and background assessments of vendors prior to their engagement, and we endeavor to monitor ongoing relationships to ensure compliance with our cybersecurity standards. These processes are designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Monitoring Cybersecurity Incidents The IT Technician and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Technician provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Cybersecurity threats have become significantly more numerous and sophisticated over time, and the oil and gas industry in particular is highly targeted by malicious actors seeking to attack oil and gas infrastructure to disrupt operations. Because we are focused on mineral and royalty interests, we do not maintain any material physical infrastructure; nonetheless, being an industry participant increases our exposure to external attacks. We are committed to safeguarding our information technology systems and data and managing the risks associated with cybersecurity threats and implemented governance structures, processes, and technologies designed to prevent, detect, investigate, and mitigate any incident that could pose a cybersecurity risk.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: To ensure that our employees are equipped to identify and mitigate material cybersecurity incidents and to empower them to help us maintain a secure environment for our operations and data assets, we utilize a multifaceted training approach aimed at fostering a culture of security awareness and responsibility among all employees. These tailored programs are designed and updated to address evolving threats and industry best practices. In addition to annual cybersecurity training for employees and contractors and simulated phishing email campaigns, our cybersecurity teams conduct tabletop exercises with our senior management team. Our cybersecurity teams also oversee a security assessment process that is used to screen our third-party service providers for cybersecurity vulnerabilities based on the level of inherent risk they pose to the company or our customers, based on factors including but not limited to the products or services they provide and their ability to access our information systems, network resources, or data.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: In the ordinary course of business, our board of directors receives annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Our Information Technology Steering Committee consists of members of the Executive Management Team and department heads with relevant technology experience, and meets on a bimonthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Technology Committee which also meets on a bimonthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Directors Technology subcommittee and/or Audit Committee sooner than its next bimonthly update.

companyName: Community West Bancshares

ticker: CWBC


text: The cybersecurity process is integrated into the Company's overall risk management system and is solely internally managed. The Company's Chief Financial Officer is responsible for identifying risks that threaten achievement of the control activities made by the Company. The risk assessment occurs as business needs change and covers identification of risks that could act against the company's objectives.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: The Company's cybersecurity risks and associated mitigations are evaluated by the Company's management and the CISO periodically, but no less frequently than annually. Management and representatives of Varagon and Man Group periodically report to the Board on information security and cybersecurity matters. Reports include, among other things, the overall state of the Company's cybersecurity program, information on the current threat landscape, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of material cybersecurity risks to the Company.

companyName: Varagon Capital Corp


text: Cybersecurity is a significant and integrated component of Central Plains Bancshares, Inc. risk management strategy. As a financial services corporation, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, The Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect The Company.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Our Chief Financial Officer and Vice President of Engineering meet regularly with third party service providers to review their performance and progress towards our cybersecurity initiatives. Program Assessment.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: We also consider cybersecurity threats with respect to third party service providers. Third parties who hold sensitive data are subject to our risk assessment process and vendor management due diligence procedures, which include an evaluation of cybersecurity risk.

companyName: Enact Holdings, Inc.

ticker: ACT


text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we have entered into partnerships with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from service providers prior to entering any engagement for services. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity team. The CISO served in this role since July 2024. Our CISO has over 20 years of experience in cybersecurity and served as a VP, CISO in the manufacturing/chemicals sector prior to joining PSEG. Our CISO also started her career at the Department of Defense and led cyber teams in the financial and retail sectors. Our CISO holds an MBA in strategy, an MSE in Computer Science, a BS in Computer Science, and multiple cybersecurity certifications, including Certified Information Systems Security Professional.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our Board of Directors has delegated to the Audit Committee oversight of risks from cybersecurity threats. The management team provides quarterly reports to the Audit Committee which cover cybersecurity and other information technology-related risks, based on our ERM framework. These quarterly updates keep the Audit Committee apprised of our ongoing cybersecurity enhancements and any emerging global threats. The Audit Committee keeps the remaining Board of Directors apprised of material risks from cybersecurity threats.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Viewbix Inc.

ticker: VBIX


text: Board of Director Oversight The Audit Committee of the Company's Board of Directors is responsible for overseeing the Company's cyber risk. The CIO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.

companyName: Arcosa, Inc.

ticker: ACA


text: We believe that mitigating cybersecurity risks is the responsibility of every employee. We take a preventative approach with respect to cybersecurity threats by building a resilient cybersecurity culture and strong IT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks; • ongoing training, testing, and utilizing other forms of social engineering awareness and education for our employees; • using cybersecurity systems and tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for reporting and alerting on known threats and anomalous behaviors; • assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners; • creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats; • engaging third-party cybersecurity experts and consultants to perform penetration testing and scanning of our systems for vulnerabilities; • obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and • maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.

companyName: SM Energy Co

ticker: SM


text: The Company maintains an enterprise-wide and Board-approved Information Security Program (the "Program"), which includes policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards that include National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the Financial Services Sector Cybersecurity Risk ("CRI") Profile, and the Federal Financial Institutions Examination Council Cyber Security Assessment. Core activities supporting the Company's strategy include leveraging people, technology and processes to manage and maintain cybersecurity controls.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: On June 13, 2023, Brunswick disclosed an IT security incident that impacted some systems and global facilities. We activated our response protocols, including pausing operations in some locations, engaging leading security experts, and coordinating with relevant law enforcement agencies. Normal global business operations resumed over the course of nine days following the incident. We estimate the incident resulted in lost revenue of approximately $ 80 million to $ 85 million and operating earnings of $ 35 million to $ 40 million. To date, Brunswick has not identified any other cyber event or risks from cybersecurity threats that could be considered material, individually or in the aggregate.

companyName: BRUNSWICK CORP

ticker: BC


text: Our Chief Experience Officer has ten years of experience in the field of information technology. The Chief Experience Officer oversees and tests our compliance with standards, remediates known risks, and leads our employee training program. The Chief Experience Officer has extensive experience in cybersecurity and possesses the knowledge and skills and background and experience necessary, as described in his biography.

companyName: Strive, Inc.

ticker: ASST


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems, or those of our CROs or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: CalciMedica, Inc.

ticker: CALC


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factor - "We are vulnerable to disruptions and security breaches of our information technology infrastructure and confidential information, which could cause material adverse effects on our business and reputation."

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: We conduct regular risk assessments to identify potential cybersecurity vulnerabilities and threats. Our Information Technology ("IT") Risk Management function, overseen by our Chief Information Security Officer ("CISO"), leads internal self-assessments, which involve evaluating the security posture of critical systems, networks and applications as well as the potential impact of cybersecurity threats on our business operations, financial condition and reputation. IT Risk Management also conducts ongoing threat monitoring and has implemented monitoring systems, including technologies such as intrusion detection systems, security information and event management tools and threat intelligence programs.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from ESRT's Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.

companyName: Empire State Realty OP, L.P.

ticker: ESBA


text: Our Vice President of Information Technology leads an IT Security Team and has overall responsibility for the security program. The IT Security Team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes. The IT Security Team works across the enterprise to assess and prepare our employees and third parties to manage cybersecurity risks and detect, investigate and respond to cybersecurity incidents. Our Vice President of Information Technology has over 25 years of information technology experience, including 23 years of leadership responsibility, and has substantial operational experience with cybersecurity policy, protection, incident response, and governance. We also utilize a third-party cybersecurity advisor to act as our CISO, supporting the Vice President of Information Technology. This fractional executive has extensive experience as a CISO and cybersecurity executive with over 25 years of expertise in designing, building, and operating transformational information security programs, is a Certified Information Systems Security Professional, and holds a Master of Science in Strategic Intelligence.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated oversight of cybersecurity risks to our Audit Committee, including overseeing the actions management has taken to identify, monitor and control such exposure. On a quarterly basis, our Audit Committee reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of our continued investment in developing our overall enterprise risk management program, our Audit Committee receives reports and presentations from management which address a range of cybersecurity topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and technological trends. Our Chief Information Security Officer ("CISO") and information security management team report to our Audit Committee on a quarterly basis on cybersecurity matters.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs Real Estate Finance Trust Inc


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive reports from the Bank's Information Security Officer and Information Technology Officer that outline the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer and Information Technology Officer update the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our external cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Financial Officer has been managing our information technology resources for over 16 years and has overseen our cybersecurity risk assessment and the implementation of our cybersecurity risk management program since its inception.

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers, including our Chief Financial Officer and General Counsel, are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its audit committee.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Traeger, Inc.

ticker: COOK


text: Our management team is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.

companyName: PEDEVCO CORP

ticker: PED


text: Our Audit Committee of our board of directors oversees our risk management processes related to cybersecurity risks and is regularly informed of such risks through presentations or reports from our CISO. In addition, our security incident response plan includes reporting certain cybersecurity incidents to our Audit Committee. Finally, our board of directors reviews cybersecurity risks on an annual basis, including discussing with management and members of the ESSC our strategy surrounding prevention, detection, mitigation, and remediation of potential security threats. While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business, financial condition, or results of operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: SPS COMMERCE INC

ticker: SPSC


text: In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. We also carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Our ISC has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 27 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The ISC provides regular reports on ongoing risk and mitigation practices, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company, to our Chief Executive Officer, Chief Technology Officer, and General Counsel, who then report to the Audit Committee and the Board.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: For information on the Company's cybersecurity-related risks, see "Information Systems, Cybersecurity and Data Privacy Risks" in "Risk Factors" on page 46 of this Annual Report on Form 10-K. While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Our cybersecurity risk management program is guided by industry standards developed by the NIST, the International Organization for Standardization ("ISO"), and other relevant organizations.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Chevron's Corporate Audit Department has a dedicated team responsible for IT and information security (including cybersecurity) audits. Chevron also leverages external resources to reinforce its cybersecurity capabilities. On a regular basis, external consultants provide a maturity assessment of the company's cybersecurity program.

companyName: CHEVRON CORP

ticker: CVX


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors--The Trust is subject to the risk of cybercrime and security breaches and incidents."

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework 1.1 (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Warby Parker Inc.

ticker: WRBY


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident detection and response, disaster recovery/business continuity policies, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, annual mandated employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: The Company recognizes the critical importance of maintaining the trust and confidence of our clients, business partners, and employees, and has developed an information security program to address material risks from cybersecurity threats. We have implemented a cross-functional approach to preserving the overall integrity of the information that the Company collects and stores by identifying, preventing where possible, and mitigating cybersecurity threats, and responding to security incidents when they occur. We also maintain controls and procedures that enable prompt escalation of certain cybersecurity incidents so decisions about public disclosure and reporting of such incidents can be timely made.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report, we have not identified any cybersecurity threats materially affecting, or reasonably likely to materially affect, our business strategy, results of operations, or financial situation. However, despite our efforts, we recognize the impossibility of eliminating all cybersecurity risks or guaranteeing the absence of undetected cybersecurity incidents. For additional information about these risks, refer to Part I, Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through its audit committee, which provides oversight of our cybersecurity program as part of its periodic review of enterprise risk management.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: We do no believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. During the reporting period, we have not experienced any material cybersecurity incidents nor any series of immaterial cybersecurity incidents that would require to be disclosed in this year-end report Management of cybersecurity risks is a component of our overall risk management strategy. We rely on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. Our operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. Our cybersecurity risk management strategy is designed to support us in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: Our information security organization is led by the CISO. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our former CISO left the Company in June 2025, and we are actively sourcing a qualified replacement. In the interim, our Deputy CISO, who has over 20 years of cybersecurity and leadership experience, is managing the CISO responsibilities. The CISO position reports to our CIDO, who has more than 30 years experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, and review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance, and regulation concerns.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview of our cybersecurity threat risk management and strategy processes from our CISO. These sessions typically cover topics such as data security posture, results from third-party assessments, progress towards risk-mitigation-related goals, our incident response plan, and material short-, medium- and long-term risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. Cybersecurity threats are also considered during meetings of our board of directors through discussions of enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management and other relevant matters.

companyName: Warner Music Group Corp.

ticker: WMG


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test and audit our safeguards. We maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and on the information and systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: AXT INC

ticker: AXTI


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and services; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: TechnipFMC plc

ticker: FTI


text: The framework consists of policies, standards, procedures, work Instructions and documentation. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. Our cybersecurity program focuses on all areas of our business, including cloud-based environments, data centers, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery / business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access.

companyName: OneMedNet Corp

ticker: ONMD


text: Our Audit Committee of our board of directors oversees our risk management processes related to cybersecurity risks and is regularly informed of such risks through presentations or reports from our CISO. Through committee reports, the Audit Committee apprises the full board of directors of any significant cybersecurity updates. In addition, our security incident response plan includes reporting certain cybersecurity incidents to our Audit Committee. Finally, our board of directors reviews cybersecurity risks on an annual basis, including discussing with management, our CISO, and members of the ESSC our strategy surrounding prevention, detection, mitigation, and remediation of potential security threats.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Cybersecurity oversight forms part of the Board 's risk oversight of the Company. The Board oversees efforts by management to manage the cybersecurity risks to which the Company may be exposed. The Board receives quarterly reports and meets periodically with the Committee chair. From its review of these reports and discussions with management and the Committee chair, the Board ensures it has sufficient awareness of the material cybersecurity risks to which the Company is exposed, enabling a dialogue about how management manages and mitigates those risks. The Board currently has four members who have obtained certifications in cybersecurity oversight.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: An incident response plan has been established, which provides detailed information on actions to take in the event of an incident. The plan defines the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high-pressure situations that can occur during incidents. We have had no material cybersecurity incidents in the last 24 months. However, during the fiscal year ended September 30, 2025, our leased office was physically broken into through a firemen's access conduit in an isolated physical security incident that did not result in a material impact on our operations, financial condition or results of operations. No items/assets were taken and the access conduit has since been disabled. We are in the process of installing additional physical security measures to make the location less vulnerable to unauthorized entry.

companyName: USBC, Inc.

ticker: USBC


text: Cybersecurity risks and previous incidents. We and certain of our third-party service providers have experienced, and expect to continue to experience, internal and external cybersecurity threats and incidents, which can result, and have resulted, in the misappropriation and unavailability of critical data and confidential or proprietary information (our own and that of third parties, including personally identifiable information) and the disruption of business operations. However, we have not been subject to cybersecurity incidents that, individually or in aggregate, have been material to our operations or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See Item 1A. Risk Factors.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: The Company's cyber risk management program also includes regular security awareness training to educate employees and new hires on the Company's cybersecurity policies, standards and practices. This training is supplemented by Company-wide testing initiatives, including periodic phishing tests. The Company provides specialized security training for certain employee roles such as application developers and privileged account holders. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The Company utilizes an external risk management tool to assist with oversight and monitoring of third-party cybersecurity risk. Each third-party service provider is vetted, evaluated and scored based on its cybersecurity methodology. For many vendors of third-party hosted applications, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports to support our assessment of our vendors' security practices. If a third-party vendor was not able to provide the requested reports, we would take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our Board of Directors plays a pivotal role in overseeing the organization's preparedness for cyber threats. This involves a comprehensive understanding of our risk profile and ensuring appropriate cybersecurity controls are in place.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL