text: Policies and Procedures The Company does not have its own cybersecurity policy, but it contracts with CROs that handle all of its data and software. Our CRO's data systems are 21 CFR 11 (Part 11) compliant, which means that they have implemented controls to ensure the reliability and integrity of electronic records and signatures. Our CRO also runs industry standard antivirus and antimalware software on their networks and has written procedures for cybersecurity management, incident response, backup and recovery, and employee training. We have reviewed the cybersecurity policies and procedures of our CRO and require them to report any cybersecurity breaches or incidents that may affect our data or systems.

companyName: Mitesco, Inc.

ticker: MITI


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with internal auditors and a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our systems and security processes. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes reviews of cybersecurity-related processes and controls in line with current international cybersecurity standards to evaluate the maturity and risks of our current cybersecurity program and consults on security enhancements. The Company further collaborates with these third-parties to conduct threat assessments, penetration testing and social engineering testing to assess the Company's systems, applications and personnel education and awareness regarding cybersecurity threats. As we are aware of the risks associated with third-party service providers, the Company maintains ongoing monitoring to ensure compliance with our service level requirements.

companyName: City Office REIT, Inc.

secItem: Item 1C


text: In the last three fiscal years, the Company has not experienced any cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, and any expenses incurred from cybersecurity incidents have been immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Operational Matters".

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: Structure and Risk Management Functions Cybersecurity is an integral part of our risk management processes. Our cross-functional risk management team evaluates cybersecurity risks alongside other operational, financial, and reputational risks, facilitating effective resource allocation and coordinated mitigation strategies. In 2021, we updated our Audit Committee charter to memorialize the Committee's role in reviewing cybersecurity matters. The Audit Committee oversees the initial assessment of cybersecurity threats as well as the Company's approach to management and mitigation of such risks, compliance with industry standards related to cybersecurity, and the Company's public disclosures related to cybersecurity matters. In addition, our Board of Directors devotes regular attention to oversight of cybersecurity risks. At least annually, the entire Board of Directors receives an update from our Chief Information Officer ("CIO") detailing our cybersecurity threat risk management and strategy processes. This update covers topics such as data security posture, results from assessments conducted by third parties, progress towards security goals, and any material cybersecurity developments, as well as steps taken in response to such developments. Our governance structure allows senior management and the Board of Directors to also remain involved in our cybersecurity strategy and risk management oversight, creating a comprehensive approach to our risk management.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Our IT team executes a series of preventive, detective and responsive measures aimed towards managing our cybersecurity risks, including the following:

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: While unauthorized persons have attempted to access our information systems in the past, and will likely continue to do so in the future, we have not, to date, identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information on these risks, see "Risk Factors—If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data or our platform, our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced and we may incur significant liabilities."

companyName: Braze, Inc.

ticker: BRZE


text: Company's executive management considers cybersecurity risk and other information technology risk as part of its risk oversight and has the ultimate responsibility for overseeing our cybersecurity strategy. Furthermore, during the year ended

companyName: Snail, Inc.

ticker: SNAL


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment. This includes maintaining an incident response plan, vulnerability management policy, and disaster recovery and business continuity plan, conducting risk assessments for certain environments, implementing security standards and certifications for certain products and systems, encrypting data in transit and at rest, controlling data access in certain environments, using multiple network controls in certain environments, segregating data, monitoring systems, performing regular security assessments for certain systems, training employees, maintaining cybersecurity insurance, maintaining dedicated cybersecurity staff, and conducting internal and external penetration tests.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Our cybersecurity strategy focuses on striking a balance between data barriers and access, and promoting vigilance among our employees, contractors, and business partners. We monitor and implement procedures, policies, and activities designed to manage our data and to maintain a high level of privacy and security within our systems. In 2023, we undertook an in-depth enterprise risk analysis and designed a program to address the most significant risks affecting our business. Our newly-developed enterprise risk program integrates cybersecurity.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: These efforts complement our current cybersecurity risk management program, which include a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. We also conduct employee cybersecurity awareness training upon onboarding to the company and periodically thereafter. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be complied with or effective in protecting our systems and information.

companyName: scPharmaceuticals Inc.


text: Our CISO holds master's degrees in both computer science and technology and business management. He also holds Certified Information Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications and has over 20 years of experience in cybersecurity at a Fortune 100 company, the largest private bank in the U.S. as well as top research universities in the U.S.

companyName: AdTheorent Holding Company, Inc.


text: The Board and the Risk Policy and Capital Committee generally engage in discussions throughout the year with management on cybersecurity risk matters. The Chief Information Security Officer and other members of the management team provide reports to the Board and the Risk Policy and Capital Committee on cybersecurity risk matters on a regular basis, including updates on our cybersecurity risk management program, recent developments in cybersecurity and privacy regulation, evolving standards, third-party reviews, general technological trends, information security considerations with respect to the company's peers and third parties, the external threat environment, and the steps the company is taking to address and mitigate the risks associated with the evolving cybersecurity threat environment. Management also discusses cybersecurity developments with the Chair of the Risk Policy and Capital Committee and other Board members between Board and committee meetings, as appropriate. The company has procedures to escalate information regarding certain cybersecurity incidents to the Board Chair. At least annually, the Board reviews and approves the company's Cybersecurity Risk Policy and Operational Risk Policy.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have adopted an IT Policies and Procedures Policy that requires all employees to acknowledge on an annual basis their responsibilities in abiding with company policies regarding safeguard our network environment. In addition, all employees receive cybersecurity training upon hire with at least annual training on best practices, social engineering threats and cybersecurity risks.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: The Company does not use any third-party consultants for assessment, management or identification of cyber security risks. The Response Team conducts regular internal testing of the Company's cyber security systems.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Cyber Risk Management and Strategy We, under the oversight of the Audit Committee of our board of directors, have implemented and maintain an enterprise risk management process, which includes periodic assessments of various risk categories, including cyber risks, across our Company. Our process for assessing, identifying, and managing risks from cybersecurity threats is informed by industry standards and supported by cybersecurity technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address cybersecurity risks.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: We rely on information technology and data to operate our business effectively and recognize the importance of implementing and maintaining cybersecurity systems and processes that allow us to protect the confidentiality, integrity and availability of our information systems and the data residing within them.

companyName: Permian Resources Corp

ticker: PR


text: Industrial Corp recognizes that cybersecurity is integral to safeguarding our operations, intellectual property, customer data, and stakeholder trust. Our cybersecurity risk management processes are designed to proactively assess, identify, and mitigate material risks from cybersecurity threats, ensuring alignment with our overall enterprise risk management framework.

companyName: Quality Industrial Corp.

ticker: QIND


text: Our Chief Operating Officer and Director of Revenue Management oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2023 or up to the date of this filing.

companyName: LUXURBAN HOTELS INC.

ticker: LUXH


text: In connection with these focus areas, we have implemented a variety of technical, physical and administrative controls to proactively prevent, detect and mitigate cybersecurity threats. These measures are designed to limit the impact of potential breaches by employing advanced logging and monitoring, robust access controls, multifactor authentication, firewalls, anti-malware and antivirus solutions, endpoint detection and response systems, network inspection tools, intrusion prevention mechanisms, content filtering and comprehensive patch and vulnerability management. Endpoints are routinely reviewed and scanned, with our Information Technology team addressing any identified issues to ensure ongoing protection.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Board is responsible for risk oversight and utilizes an enterprise risk management process to assist in fulfilling its oversight responsibilities. The Board has delegated responsibility for overseeing the monitoring and assessment of risks related to cybersecurity to the Audit Committee.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: Currently, the security of our information is managed by Mr. Ryohei Uetaki, our sole officer and director. While Mr. Uetaki believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.

companyName: Ultimate Holdings Group, Inc.

ticker: UHGI


text: See "Risk Factors – Risks Relating to Information Technology and Cybersecurity – Cybersecurity attacks on any of our facilities, or those of third parties, may result in potential liability or reputational damage or otherwise adversely affect our business."

companyName: TIDEWATER INC

ticker: TDW


text: This Cybersecurity Program is a critical component of Uber's enterprise risk management program, through which Uber reviews business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others. The Cybersecurity Program is designed to assess, identify, and manage risks from cybersecurity threats.

companyName: Uber Technologies, Inc

ticker: UBER


text: Our service providers, and third-party hardware or software applications on our networks and company-issued devices, may pose cybersecurity risks. As a result, we assess these parties for cybersecurity risks using information supplied by our counterparty and/or third parties. Internal or external audits are conducted based upon the level of risk presented. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.

companyName: MARZETTI CO

ticker: MZTI


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party vendors, service providers and business partners, we have implemented stringent processes to oversee and manage these risks. We conduct thorough and annual security assessments of all third-party file transfer protocols, and we perform in-depth reviews of hosted applications including, but not limited to, confirmation of SOC 2, ISO 27001, or other relevant security certifications.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our board of directors oversees our cybersecurity risk and receives, at a minimum, a quarterly cybersecurity report and a bi-annual update from IT leadership, which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and ongoing cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on at least an annual basis from senior management, including leaders from our Information Technology, Internal Audit, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: The Chief Information Officer ("CIO") and Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis at the Audit Committee meetings. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks to ensure that the Board Director's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance for major initiatives. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee or Board of Directors through the Board-approved escalation protocol.

companyName: Cornerstone Building Brands, Inc.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our customer, prospect, supplier or employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We generally require that third-party service providers that access, host our data, or could otherwise introduce cybersecurity risk to us, enter into contracts that obligate them to manage their cybersecurity risks in certain ways and report any cybersecurity incidents to us.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Our ISP operates as an enterprise-wide function that monitors external and internal threats to assess cybersecurity risk and drives risk-based remediation across all departments. The Company's ISP is aligned to the Federal Financial Institutions Examination Council standards and is built on recognized best practices and standards for cybersecurity and information technology. We identify vulnerabilities and remediate based on risk and priority. Our ISP team conducts annual security awareness training, regular phishing exercises, sponsors Company-wide security awareness programs, and provides regular updates across the Company to keep employees engaged and informed on ways to mitigate cybersecurity risk.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: Under our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: The Company maintains policies and procedures for preventive controls for enterprise applications including, but not limited to, access controls and change management. In addition, we maintain relevant business continuity and disaster recovery plans as part of our overall cybersecurity risk management strategy.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Viewbix Inc.

ticker: VBIX


text: As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Item 1A "Risk Factors" under the heading "Risks Related to Technology, Cybersecurity and Intellectual Property," which should be read in conjunction with the foregoing information.

companyName: KORN FERRY

ticker: KFY


text: Our cybersecurity risk management program includes operational, technical and physical controls to protect against and respond timely to cybersecurity threats. To address evolving cybersecurity risks and corresponding regulations, our policies and procedures are benchmarked to industry, regulatory and cybersecurity frameworks (e.g., National Institute of Standards and Technology).

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We also engage in periodic testing programs, using both internal assets and external consultants, including penetration testing, and incorporate multiple layers of physical, logical and written controls into our cybersecurity risk management program. Our IT/IS team leverages centralized identity management, encryption configurations and technologies on the systems, devices, and third-party connections used in our operations.

companyName: Arista Networks, Inc.

ticker: ANET


text: Board Oversight of Cybersecurity Risk. Our Board's role is to engage in informed oversight of enterprise-wide risks as managed through our ERM program, including cybersecurity. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our VP of Technology and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.

companyName: Origin Materials, Inc.

ticker: ORGN


text: While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Strategic and Operational Risks – We are exposed to risks related to cybersecurity," which should be read in conjunction with the foregoing information.

companyName: GARTNER INC

ticker: IT


text: Our cybersecurity program is managed by our IT Administrator who reports directly to our Chief Executive Officer. Our IT Administrator and the IT function monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the processes described above, including the operation of the Company's incident response plans, which include appropriate escalation to the executive team and the Audit Committee. As discussed above, the IT Administrator reports at least semiannually to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: TREES Corp (Colorado)

ticker: CANN


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, and/or reputation. We employ continuous monitoring systems and other technologies and security controls to assist us with the identification of cybersecurity risks and threats. These strategies include, among others, the application, adoption or modification of cybersecurity policies and procedures, implementation of administrative, technical, and/or physical controls and employee training, education, and awareness initiatives.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: The Internal Audit Department The Internal Audit department of SCC operates in accordance to an Annual Plan that has been approved by the SCC Audit Committee. This plan encompasses the design and execution of system audits, including testing of cybersecurity controls and protocols. Recommendations from both Internal and External experts are thoroughly reviewed and evaluated and may be implemented if findings so merit.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Managed Detection and Incident Response: We employ advanced endpoint protection and managed detection and response services to quickly identify and respond to potential security incidents. Our incident response team is equipped to handle various types of cyber threats and minimize their impact on our operations.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Hanover's Enterprise Risk Management ("ERM") framework leverages the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") principles. This alignment is intended to bolster effective risk management practices that meet regulatory expectations. ERM considers all eight major risk categories including credit, market, liquidity, operational, compliance, reputation, legal, and strategic risk and further enhances the Company's financial resiliency by integrating ERM with our capital and strategic planning processes. Cybersecurity is a major component of the broader operational risk category given the increase in risk due to the increased reliance on technology both for operating processes and delivery channels.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: We assess our information security program using an industry-leading cybersecurity framework, the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). A risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on us and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.

companyName: Torrid Holdings Inc.

ticker: CURV


text: While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: As part of the cybersecurity program, we have adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, we have established a CSIRT Steering Committee which includes, among others, the Chief Financial Officer, CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including the CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the Board of Directors at regularly scheduled meetings or more frequently, as needed.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: During the fiscal year ended March 31, 2024, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: Our Information Security Officer directs our enterprise information security department and manages our information security program. The responsibilities of enterprise information security department include cybersecurity risk assessment and defense, vulnerability assessment, incident prevention, mitigation, response, and remediation, data access governance, third-party risk management, and business resilience. Our Information Security Officer has over ten years of relevant expertise and formal training in the areas of information security and cybersecurity risk management in the financial institutions industry.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Managing technology risks, including risks related to cybersecurity, is an integral part of Comerica's enterprise risk management framework and processes. As such, Comerica uses a library of processes, risks and controls to assess, identify and manage cybersecurity risks. Comerica measures such risks in part by estimating the likelihood and potential impact of incidents. Comerica seeks to manage such these risks by designing, documenting, and implementing controls, testing those controls through compliance assessments and internal and external audits and, in some cases, by transferring the risk in whole or in part through methods such as insurance. When an incident occurs, Comerica works to remediate the incident while complying with its regulatory obligations, and then evaluate the remediation for effectiveness. Comerica communicates on risk management matters through documented policies and procedures, management and Board committee reporting, and training and other employee communications.

companyName: COMERICA INC

ticker: CMA


text: For the year ended December 31, 2023, we have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Cass is dependent on third-party vendors to support operations and business objectives. Recognizing the interconnected nature of the Company's business, Cass places emphasis on managing third-party cybersecurity risk by maintaining a Vendor Management Policy. This policy establishes guidelines for conducting due diligence on vendors' security practices, making ongoing risk assessments and conducting extensive control reviews of identified high-risk vendors.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations (CROs), contract manufacturing organizations (CMOs), cloud hosting and other SaaS providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we take various measures designed to help manage risk associated with our use of certain of these providers. These measures include, for example, obtaining confirmation of certain cybersecurity certifications, information security questionnaires, and imposition of certain contractual obligations.

companyName: DBV Technologies S.A.

ticker: DBVT


text: Our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to management regarding such oversight. The Board of Directors receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Freeze Tag, Inc.

ticker: FRZT


text: As of the date of this filing, we have not experienced any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, future threats or incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Company—"Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "We are highly dependent on information systems, and system failures could significantly disrupt our business, which may, in turn, have a material adverse effect on us." We maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters. Management or the Audit Committee will provide a comprehensive update to the Board on cybersecurity threats and risk mitigation generally at least annually, and more frequently as relevant.

companyName: Talkspace, Inc.

ticker: TALK


text: Our Information Technology Officer is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: Cybersecurity operational measures Led by our CISO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC's oversight through SIEM, and with support of the Company's CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: Risk assessments designed to help identify material cybersecurity risks to critical systems integral to our business and our broader enterprise information technology environment. use of external service providers, where appropriate, to assess, test or assist with aspects of security controls. cybersecurity awareness and compliance training that occurs annually and is mandatory for all employees. cybersecurity plan that includes procedures for responding to a cybersecurity incident. have not experienced any material cybersecurity violation or occurrence over the last three years.

companyName: OVERSEAS SHIPHOLDING GROUP INC


text: Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. We rely on a third-party service provide r to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: The cybersecurity function is centralized under the Senior Vice President and Chief Information Officer, who has over three decades of experience in information technology. The cybersecurity function is comprised of a dedicated team of professionals who work continuously to monitor risks relating to cybersecurity resilience strategy, policy, standards, architecture, and processes. We identify and address cybersecurity risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements. This requires a comprehensive program involving advanced monitoring and defense technology along with recurring situational drills that exercise incident response and crisis management plans. We leverage dedicated internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for vulnerability testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our technology environment.

companyName: ONE Gas, Inc.

ticker: OGS


text: The Chief Information Officer (CIO) and the Director of Information Security are directly responsible for managing cyber risk on a daily basis. The CIO reports to the Chief Administrative Officer (CAO), who oversees the Company's overall information technology strategy and governance. Executive oversight, spearheaded by the CAO, ensures strategic alignment across the organization. With a wealth of leadership in both public and private sectors, these individuals collectively possess years of invaluable experience in information technology and security.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: In case of a cyber incident with significant or material impact, the CISO would escalate to senior leadership and depending upon the severity and scope of any cyber incident, the Company will invoke its Corporate Crisis management plan.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.

companyName: Community West Bancshares

ticker: CWBC


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. The Bank's internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our Manager's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Key components of our Cybersecurity Program include, but are not limited to, the following: • Information Security Governance: We designed what we believe are appropriate measures, policies and procedures to ensure that information and information systems are properly protected given the nature of our businesses and the size and complexity of our organization, including our reliance on third parties; • Organization: The Information Security team, led by the Chief Information Security Officer (CISO), is responsible for implementing and managing the Cybersecurity Program with executive oversight from the Chief Executive Officer and Chief Financial Officer, as well as oversight from our Board of Directors. Our CISO has extensive cybersecurity knowledge and skills gained from over 26 years of work experience on the information security team at SEI. In addition to the CISO's cybersecurity experience, he has certifications in risk and information systems control along with information systems auditing; • Cybersecurity Controls: We have implemented what we believe are appropriate preventative measures to protect SEI's infrastructure, systems, and data. These measures include network architecture segmentation, system and platform hardening, in-transit and at-rest encryption, dynamic security awareness training, regular vulnerability scanning and penetration testing, firewalls, web proxy filtering, and multifactor authentication, all of which we constantly evaluate and upgrade as we believe is needed based on our risk assessments; • Managed Detection and Response: Our security operations center's uninterrupted monitoring processes utilize tools such as network and host-based intrusion detection systems, endpoint detection and response technology, distributed denial of service detection and mitigation service, and centralized security and information event management (SIEM). These efforts are further supplemented by signals operations and threat hunting that provide the incident responders the ability to write custom detections to complement commercial technology controls and execute triage/analysis, threat intelligence, and response; • Independent Audits: We are subject to industry regulatory examinations. Our internal audit function provides independent assessment and assurance on the overall operations of our Cybersecurity and Privacy Programs and the supporting control frameworks. We also engage various reputable third parties to perform independent auditing and testing as well as network and web application penetration testing; • Risk Management Oversight: Enterprise Risk Management, through the Enterprise Risk Committee, provides independent monitoring and reporting of cybersecurity risks commensurate with our Technology Risk Program. In addition, we leverage our Third Party Risk Management, Insider Threats, Business Continuity and Disaster Recovery programs to supplement our Cybersecurity Program; and • Privacy Oversight: In addition to our Enterprise Risk Management functions, our Legal and Compliance team maintains a privacy risk management program to assess, manage and report privacy risks related to how we are collecting, using, sharing, and storing user data. Our Privacy team works with our Third Party Risk and Information Security teams to manage privacy-related issues.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: Under our enterprise risk management initiative, the Board of Directors ("Board") and the Audit Committee engage in regular discussions with our senior management team, including the Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, to manage cybersecurity threats. The Board and Audit Committee are promptly briefed on any cybersecurity incident surpassing predetermined reporting thresholds, receiving continuous updates until resolution.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: Information Security Risk assesses technology risks and controls, evaluates application systems' conformance to internally defined and approved security standards, coordinates audits and examinations for Information Technology ("IT") and Information Security, as well as tracks open risk issues and exceptions. IT Security defines security policies and standards, conducts security awareness and training, evaluates security configuration and assesses vulnerability risk.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Management's Responsibility The Bank's cybersecurity program is managed by our CISO, who reports to the Audit Committee. Management's Corporate Information Security Committee (the "Security Committee"), led by our CISO, is a governance body that drives alignment on security decisions across multiple departments and functional areas within the Bank, while monitoring and managing Cyber risks to minimize exposure to the Bank. Members of the Security Committee include the Chief Information Officer ("CIO"), the CRO, and the COO. The Security Committee oversees processes for assessing, identifying, and managing material risks from cybersecurity threats. The Security Committee meets at least quarterly to review cybersecurity performance metrics, identify cybersecurity risks, and assess the status of approved cybersecurity enhancements. The Security Committee also considers and makes recommendations on cybersecurity policies and procedures, service requirements, and risk mitigation strategies.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: The Company reports on its information security program to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reports matters to the Board of Directors as needed. Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: Oversight of Risks Related to Cybersecurity Threats Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: The work done by the Information Security team integrates into the Company's overall Enterprise Risk Management ("ERM") program. Data is contributed to the ERM team in support of our broader operational risk framework and processes through completion of the Risk and Control Self-Assessment for IT and cyber, which is aggregated into the larger operational risk program. Members of IT and Information Security senior leadership participate on the Company's Operational Risk Committee ("ORC"), which is a standing committee whose purpose is to review and monitor threats to our business operations and strategy that manifest from inadequate or failed internal processes, controls, people or systems or from external events. In addition, the Company's Internal Audit team performs an annual security audit that focuses on cybersecurity risks, the results of which are reported to the Company's IT leadership team and the Audit Committee of the Company's Board of Directors. This audit process provides an additional layer of support to help ensure that cybersecurity risks are managed and responded to appropriately.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: The Company has implemented a variety of mechanisms that are designed to detect, identify, assess, manage, and respond to material risks from cybersecurity threats. The Company's processes for identifying, assessing, and managing cybersecurity risks include: • a rigorous internal audit process to evaluate the Company's cybersecurity strategies, with the Audit Committee apprised of risks or control failures that are identified during the audit; • participation in multiple peer-sharing networks to obtain industry-wide intelligence regarding specific cybersecurity threats and industry best practices to minimize cybersecurity risks; • participation in simulated cyber-event tabletop exercises designed to test the Company's incident response capabilities and the robustness of its cybersecurity program; • an information security program that is regularly reviewed, tested, and updated, and includes vulnerability and patch management programs, incident response planning, security monitoring, employee training, and security awareness testing; • cybersecurity insurance to mitigate the financial impact of a cybersecurity incident on the Company's business and financial condition; and • periodic regulatory examinations that include an assessment of the Company's cybersecurity management, processes, and controls. In addition to the internal programs outlined above, the Company engages with external cybersecurity experts to conduct thorough evaluations of the Company's cybersecurity processes and controls. These third-party consultants conduct periodic comprehensive vulnerability and penetration testing, alongside audits of high-risk technology systems designed to evaluate the efficacy of the Company's cybersecurity measures. The Company has also retained a third-party cybersecurity firm to assist with the Company's response to any future cybersecurity breaches.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: The Audit Committee assists the Board in the oversight and monitoring of cybersecurity matters. The Audit Committee regularly reviews and discusses the Company's cybersecurity risks with management, including the Company's Head of Corporate Information Security, its General Counsel and the Heads of Compliance and Business Conduct, Business Assurance, and Internal Audit, and receives updates, as necessary, regarding cybersecurity incidents. The Chair of the Audit Committee regularly reports the substance of such reviews and discussions to the Board, as necessary, and recommends to the Board such actions as the Audit Committee deems appropriate.

companyName: Apple Inc.

ticker: AAPL


text: To our knowledge, there have been no cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Ellington's cybersecurity team is led by Ellington's Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO led large technical efforts such as the development of Ellington's proprietary internally hosted rapid application system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has led several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.

companyName: Ellington Financial Inc.

ticker: EFC


text: We assess the cybersecurity posture of third-party service providers, vendors and suppliers at least annually and whenever the vendor implements significant product or operational changes. We maintain consistent communications via email, chat services, ticketing systems, and regular meetings with these partners to promptly address and remediate any perceived vulnerabilities.

companyName: Spire Global, Inc.

ticker: SPIR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal staff as part of the Board's continuing education on topics that impact public companies.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: We also endeavor to apprise employees of emerging risks and require them to undergo regular security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: We have processes in place to regularly assess, manage and identify potential risks from cybersecurity threats. Our cybersecurity policies and processes are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools and processes that are designed to help identify and investigate any security incidents in a timely manner. When any risk or threat is identified we have a designated group of individuals including representatives from our information security team, finance team, compliance teams and legal teams who are involved in the assessment of the risk based on probability and potential impact to key business systems and processes. Risks that are considered to have a high impact to our business are incorporated into our enterprise risk management program. The tracking of these risks and the processes we have in place to address cybersecurity threats are and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Adaptimmune Therapeutics PLC


text: For additional information, see Risk Factors – Risks Related to Our Business. Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cybersecurity incidents and other unauthorized access, disclosure, and disruption.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Cybersecurity risk is the business risk associated with a vulnerability to financial or reputational loss due to a cyber attack or a data breach. Our technologies, systems and networks may be subject to cybersecurity threats. Our business, like others within the energy technologies industry, is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business, some of which are managed by third-party service providers on whom we rely to help us collect, host or process information.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Our cybersecurity program is fully integrated into the Company's overall enterprise risk management program. Our Vice President, Risk and Compliance (VP of Risk) facilitates the enterprise risk management program, and helps ensure that risk management is integrated into our strategic and operating planning process. The VP of Risk works closely with the CIO and his information technology security team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: In general, our incident response process involves five phases: • Identify— in which we gather an understanding of how to manage our cybersecurity risks to our systems, assets, data and capabilities, including through threat modeling, cybersecurity threat intelligence from industry-recognized forums and sources, internal audits, third-party reviews and assessments, vulnerability scans and penetration tests; • Protect— in which we implement controls and safeguards to protect or deter cybersecurity threats, including through firewalls, VPNs, identity and access management and intrusion prevention systems; • Detect— in which we engage in continuous monitoring to provide proactive and real-time alerts of cybersecurity-related events; • Respond— in which any threats are timely reported to responsible teams, and triaged for purposes of preliminary classification and escalation, and assessment for possible notification and disclosure requirements; and • Recover— in which business continuity plans are implemented, vulnerabilities are identified and mitigated, legal obligations and risks are identified, and our systems are returned to operational readiness.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of IT, the Chief Executive Officer, and the Chief Financial Officer. Our Senior Director of IT has approximately 25 years of experience in IT and cybersecurity.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our Board of Directors is primarily responsible for risk oversight and discharges its responsibility directly or indirectly through its committees. In general, our risk management is designed to be facilitated through a top-down and bottom-up communication structure whereby the Board and/or its committees provide oversight and direction, and management is charged with the day-to-day management of risks, regular assessment of the risk environment and regular reporting to the Board, which may include management reports and reports from outside advisors and consultants engaged by the Board, a specific committee or management, as appropriate. This overall risk management and oversight framework includes risks related to cybersecurity threats. Pursuant to its charter, the Audit Committee oversees senior management's risk management processes related to assessing, identifying and managing cybersecurity risks in an effort to, among other things, help align our risk exposure with our strategic objectives. The Audit Committee meets no less frequently than annually with our IS department to discuss, among other things, recent trends in cyber risks, cybersecurity incidents, if any, and our cybersecurity defense strategy to protect against cyber-attacks and intrusions. These discussions with the Audit Committee are led by our IS Leaders and senior management. The Audit Committee provides regular updates to the full Board of Directors on matters under its purview, including risk management and cybersecurity matters.

companyName: BXP, Inc.

ticker: BXP


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.

companyName: BCP Investment Corp

ticker: BCIC


text: We also engage other consultants, and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our Board of Directors and Audit Committee are responsible for overseeing our cyber security risk management and strategy.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: The Board recognizes the importance of cybersecurity in maintaining the trust and confidence of our stakeholders, patients and employees. Our Audit Committee is central to the Board's oversight of cybersecurity and bears the primary responsibility for overseeing risks associated with our information systems and technology, including cybersecurity.

companyName: Biohaven Ltd.

ticker: BHVN


text: Risks from Cybersecurity Threats No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition. For further detail on the potential risks, see Part I, Item 1A of this Annual Report on Form 10-K for the year ended December 31, 2024.

companyName: GoPro, Inc.

ticker: GPRO


text: The Audit Committee of the Company's Board of Directors is charged with reviewing, discussing with management and overseeing the Company's information technology and cybersecurity risk. The Audit Committee receives reports on cybersecurity risk and management thereof at least semi-annually, and the full Board of Directors receives such reports at least annually.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We track cybersecurity risk as an enterprise risk through our enterprise-wide risk management ("ERM") framework. The Board of Directors is actively involved in oversight of our ERM framework and receives regular reports on risks, including cybersecurity risks. We engage third parties to conduct assessments, tests, and simulation exercises to validate and further mature our cybersecurity program, the results of which are reported to the Executive Leadership Team, including CTO, and the Board of Directors. We maintain cybersecurity insurance coverage to help mitigate the financial impact of a cybersecurity incident.

companyName: nVent Electric plc

ticker: NVT


text: Our Advisor's information technology and internal audit teams utilize frameworks based on industry standards to identify and mitigate information security risks and oversee an active cybersecurity training program. For example, in January 2023, our Advisor's information technology team held a tabletop exercise with senior management of the Advisor to consider different cybersecurity scenarios. Our Advisor's information technology team also recently worked with various third-party consultants to update our incident response plan.

companyName: Net Lease Office Properties

ticker: NLOP


text: • advanced endpoint detection/response, • user behavior analytics, • vulnerability identification/patching, • email threat prevention, • data loss prevention, • privileged access management, and • ongoing/annual phishing training / testing.

companyName: BELDEN INC.

ticker: BDC


text: Depending on the environment, systems and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plan; risk assessments; encrypting certain data; network security controls; data segregation; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: While cybersecurity risks are inherent to our industry, we have experienced no material impact on our business strategy, operations, or financial condition to date. We remain vigilant in managing these risks through our comprehensive security program.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: We are subject to cybersecurity risks, which include intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risks can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. For a discussion of cybersecurity and related risks impacting our Bank, see Risk Factors starting on page 21.

companyName: Federal Home Loan Bank of Chicago


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: We employ processes for assessing, identifying, and managing material risks from cybersecurity threats that are incorporated into our overall risk management system. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our system includes procedural and technical safeguards, response planning, and reviews of our policies. We engage various external entities, including consultants, to improve and enhance our cybersecurity processes and oversight. We provide employees and consultants with cybersecurity and prevention training including timely and relevant topics covering phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee's cyber risk management program.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the President of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the President have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.

companyName: HCI Group, Inc.

ticker: HCI


text: The Company's information systems employ storage and recovery services from various third parties, including Microsoft, as its cloud service providers, which provides an additional level of protection from cybersecurity threats.

companyName: REVELATION BIOSCIENCES, INC.

ticker: REVB


text: Our Board of Directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Management's Role and Expertise in Assessing and Managing Cybersecurity Our Cybersecurity and Information Technology organization is led by our CIO, who is responsible for cybersecurity risk management. Our CIO has more than 27 years of experience in the IT industry. Since 2006, he has held multiple roles at the Company and most recently as Vice President of IT Strategic Solutions.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. We have adopted the HITRUST CSF Assurance Program for Cloud assessment to inform this risk assessment process. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.

companyName: Talkspace, Inc.

ticker: TALK


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the headings "We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results," "If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected," and "If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities" included as part of our risk factor disclosures included in Item 1A of this report, which disclosures are incorporated by reference herein.

companyName: Workday, Inc.

ticker: WDAY


text: Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, we cannot guarantee the security measures are infallible.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: Education and Awareness We have implemented a security awareness and training program designed to educate employees on the importance of information security and to help them identify and respond to potential security incidents. The program includes annual required cybersecurity training for professional employees, role-based cybersecurity training, and a phishing awareness program for all employees. Additionally, the ELT and Board of Directors have conducted cybersecurity incident and response simulation exercises.


text: TMCC's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third-party service providers with access to TMCC's systems and data, as well as such third-party service providers' adherence to certain cybersecurity standards and processes. As appropriate, TMCC requires such third-party service providers to agree to be subject to cybersecurity evaluations by TMCC.

companyName: TOYOTA MOTOR CREDIT CORP


text: Our management team, including our Chief Executive Officer, EVP Product & Technology, Chief Financial Officer and General Counsel, work collaboratively to design, implement and review our cybersecurity policies and processes and to respond to any cybersecurity incidents in accordance with our plans. Among our management team, our App Ops and Engineering teams are most responsible for assessing and managing cybersecurity risks. These teams have several years of experience in the IT industry, including experience managing cybersecurity risks. Our CEO, EVP Product & Technology, CFO and General Counsel each have degrees in their respective fields and each have more than 20 years of business experience. Our teams use the technical systems that we have implemented to monitor for cybersecurity threats and they coordinate responses to any perceived risks or vulnerabilities with our senior management team. Through ongoing communications among these teams, our EVP Product & Technology and other key team leaders monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and, when appropriate, report risks, threats or incidents to our Audit Committee.

companyName: MARIN SOFTWARE INC


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners to conduct key operations across our enterprise.

companyName: Keenova Therapeutics plc


text: Our cybersecurity strategy leverages administrative safeguards that include policies, procedures, and processes to assess, identify, and manage risks from cybersecurity threats. We have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides a framework and guidance for investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.

companyName: Valaris Ltd

ticker: VAL


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity measures throughout its operations that are designed to address cybersecurity threats and incidents. The Company has a Cyber Security Policy (the "Policy") that includes guidelines and provisions for security measures to help mitigate the Company's cybersecurity risk. The Policy applies to all Company employees, contractors, volunteers, and anyone who has permanent or temporary access to the company's systems and hardware ("Covered Persons"). In addition to outlining measures Covered Persons are expected to take to help protect the Company's information technology and cybersecurity infrastructure, the Policy includes a process for Company employees who identify a cybersecurity risk to report and escalate such risk to the Executive Director of Administration (the "EDA") for investigation.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: Our management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Gamida Cell Ltd.


text: Our Board, with oversight by the Audit Committee, oversees management's processes for identifying and mitigating cybersecurity risks. Executive management including our Chief Information Security Officer ("CISO"), who reports to our General Counsel & Chief Risk Officer, updates the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.

companyName: BEST BUY CO INC

ticker: BBY


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our audit committee, per the audit committee charter. Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. In addition, management alerts the audit committee of any material cybersecurity incidents. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information on cybersecurity-related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: FERRELLGAS PARTNERS FINANCE CORP


text: We believe cybersecurity is a critical component of our enterprise risk management function. Our strategy regarding Information Security ("InfoSec") includes a comprehensive, proactive, and sustainable risk-based approach, assessing the risk posed to the Company at the strategic, operational, financial, and reputational levels. We take appropriate preventive, detective, and response measures to mitigate these risks on a continuing basis.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Board Risk Oversight. Our Board of Directors (the "Board") oversees our policies, procedures, and processes related to risk management, including assessing, identifying, and managing risks from cybersecurity threats. This oversight is performed primarily through the Audit Committee. The Board has delegated to the Audit Committee responsibility for reviewing, with management, the guidelines and policies with respect to: (a) risk assessment and risk management, (b) our major risk exposures, and (c) the steps management has taken to monitor and control such exposures.

companyName: EMCOR Group, Inc.

ticker: EME


text: We have implemented procedures for assessing, identifying and managing significant risks from cybersecurity threats and have incorporated these procedures into our overall risk management systems and processes. We regularly evaluate significant risks from cybersecurity attacks, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored there. The program to manage cybersecurity risks has tools and activities designed to identify, examine and manage current and potential cybersecurity threats, as well as plans and strategies designed to deal with threats and incidents.

companyName: 89bio, Inc.


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our program, including our accountants, independent assessors (for example, for penetration testing) of our cybersecurity program, external legal counsel and other consultants.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management, with the Board Risk Committee assisting the Board with oversight of the Company's cybersecurity risk program and reporting. The Board of Directors appoints the CISO, and the CISO is given the full authority of the Board for administering and executing the Company's written information security program. The CRO and CISO deliver reports to the full Board of Directors on the status and effectiveness of the Company's written information security program, and reports to the Board Risk Committee any emerging threats or cyber risks on a periodic basis throughout the year. The Board Risk Committee has also approved an Information Security and Cybersecurity Risk Appetite Statement.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and Company management and reports to the Company's Board of Directors and/or certain Board committees. As noted above, the Risk Oversight Committee regularly receives reports on cybersecurity matters from senior IT leadership.

companyName: STURM RUGER & CO INC

ticker: RGR


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall information technology (" IT ") processes. As part of our IT process, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Under our Cybersecurity Program, our information technology team and our senior management, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to manage those risks. Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third-party information technology system providers. When cybersecurity incidents occur, our actions are guided by an incident response plan to (i) detect, contain and eradicate threats, (ii) notify the executive management and the Audit Committee Chairman as appropriate based on the severity level of the cybersecurity incident, (iii) recover compromised data and information systems, (iv) limit impacts of any such incident on our operations and (v) report any such incident as required by law or as otherwise appropriate.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: We are subject to extensive federal and state regulation of customer privacy and the security of financial information. Our federal regulator, the FRB, is part of the Federal Financial Institutions Examination Council (FFIEC), which publishes extensive guidelines and examination procedures that are used to review the security of Bank of Hawai i and other financial institutions.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Risk Assessment and Management We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data.

companyName: Twist Bioscience Corp

ticker: TWST


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, along with all companies of a similar size, we face common cybersecurity threats. These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors. Our customers, supply-chain providers, and subcontractors face similar cybersecurity threats, and an incident impacting us or any of these entities could materially adversely affect our business operations.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: Like many financial institutions, the Company has experienced cyber-based attacks and other attempts to compromise its information systems and expects that it will continue to experience these attacks and attempts in the future. In 2021, the Bank was the target of a ransomware attack in which an external actor illegally accessed and/or acquired certain data on its network. As a result, the Bank was sued in a purported class action lawsuit. The lawsuit is currently in process of settlement, subject to final court approval. See "Item 3. Legal Proceedings," above. While the Company has not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risk Related to our Business -- System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.," above.

companyName: PCB BANCORP

ticker: PCB


text: The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody's Analytics obtains third-party audits in connection with the ISO 27001 certification and SOC 1 and SOC 2 attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.

companyName: MOODYS CORP /DE/

ticker: MCO


text: The Company's processes for identifying, assessing, and managing material cybersecurity risks are incorporated into its overall Enterprise Risk Management process. The Company maintains a comprehensive cybersecurity risk management program, overseen by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), to support the security, confidentiality, integrity, and availability of its critical IT systems and information.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Our cybersecurity function, which comprises, in part, our Chief Financial Officer and third-party service providers (including our managed security services provider, or MSSP), helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats (including third party threat assessments), using external intelligence feeds, coordinating with law enforcement regarding certain threats, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, network security controls, systems monitoring, and asset management, tracking, and disposal.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Our incident response plan is designed to address security incidents effectively, supported by stringent information security policies and the implementation of a security information and event manager system for real-time analysis and reporting of security events and incidents. As part of our security commitment, we undergo penetration testing to assess whether our necessary security controls are maintained.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee reports the results of their oversight function to the Board of Directors.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. To help the Company address these risks, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity risk management program is integrated within our enterprise risk management program.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BXPE, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: Blackstone Private Equity Strategies Fund L.P.