text: If the Company is notified of a cybersecurity incident affecting the Company's information systems, either by an employee, our defensive infrastructure, a regular system audit or another mechanism, the IRT, led by the CDO, will perform the technical functions required to analyze and contain such an incident, including, but not limited to, technical triage, in-depth analysis, technical mitigation and any necessary recovery actions. The IMT will be activated by the CISO, the CRO or another member of the team to assist in the response and evaluate the cybersecurity threat and coordinate the business decisions necessary to limit the impact of the cybersecurity incident during and after the response. The IMT will also perform similar functions if we detect or are alerted to a cybersecurity threat or incident involving a third-party service provider.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Cybersecurity is a critical component of our enterprise risk management framework and a key area of focus for both our Board and management. Our approach is to treat cybersecurity not just as a technology issue, but to recognize that it can have wide-ranging impacts on the business, operations, and financials of our company.

companyName: Sunrun Inc.

ticker: RUN

secItem: Item 1C


text: Compliance Framework The cybersecurity program aligns with the National Institute of Standards and Technology's Cybersecurity Framework. The IT Department, in collaboration with external vendors, diligently works to detect vulnerabilities, identify compromised devices, and maintain compliance across the organization's IT systems.

companyName: i-80 Gold Corp.

ticker: IAUX


text: The CISO oversees a training and awareness program for employees to take part in protecting the Company against cybersecurity risks. We have implemented annual mandatory security education to help employees understand cybersecurity risks and comply with our cybersecurity policies. Additionally, we provide frequent communications around pertinent cybersecurity topics and policies to all employees. We also provide additional cybersecurity and data protection training to employees in certain roles.

companyName: STRYKER CORP

ticker: SYK


text: Our cybersecurity governance structure is designed to achieve effective oversight and management of cybersecurity risks across the organization.

companyName: IREN Ltd

ticker: IREN


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, annual external penetration testing using an experienced third-party company; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.

companyName: AMC Networks Inc.

ticker: AMCX


text: Our entire board of directors is responsible for the strategic leadership and direction of our cybersecurity program and has oversight over cybersecurity risks. Our management may provide periodic presentations to the board on our cybersecurity program, including updates on cybersecurity risks, strategy and incident management, as applicable. Our cybersecurity risk management is also administrated at a management level through a multi-disciplinary Technology Business Review Committee comprised of members of our operational and organizational management, as well as our outsourced Virtual Chief Information Officer. The Technology Business Review Committee is tasked with identifying and monitoring what we believe to be the key technology risks currently facing the Company, including cybersecurity risks. The committee meets on at least a quarterly basis and on an as-needed basis to address risks, regulatory requirements, potential threats, vulnerabilities, available mitigation strategies and technologies, operational imperatives and changes, and progress updates on relevant projects related to our IT and cybersecurity.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: The Company's Information Security strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. The Company's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. The Company implements risk-based controls to protect the Company's information, information systems, business operations, products and related services, and the information of the Company's customers. The Company has adopted security-control principles based on the Federal Financial Institutions Examination Council (FFIEC) Cyber Security Assessment Tool (CAT), and other industry-recognized standards, and contractual requirements, as applicable. The Company also leverages industry associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds, and other similar resources to inform the Company's cybersecurity processes and allocate resources.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: As part of the processes described above, we regularly engage external auditors and consultants to assess our cybersecurity programs and compliance with applicable practices and standards. Our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013 and AICPA SOC 2 Type II, which includes all five of the Trust Services Criteria.

companyName: Bandwidth Inc.

ticker: BAND


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: EOG has invested in and implemented multiple technologies, controls, and procedures designed to protect its information systems and related infrastructure; identify, assess and remediate vulnerabilities; and monitor and mitigate the risk of data loss and other cybersecurity threats and intrusions.

companyName: EOG RESOURCES INC

ticker: EOG


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see the risk factor "Our inability to protect our systems and data from cybersecurity threats or other technological risks could adversely affect our business operations, or stock price and damage our brand and reputation" in Item 1A of Part I of this Report.

companyName: NCR Voyix Corp

ticker: VYX


text: Business activities, products, and services are managed by experts in their respective fields, with employees receiving training to detect and prevent material cybersecurity threats. Business leaders are expected to understand specific threats within their areas of responsibility and adhere to established processes and standards to control such threats.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Wolfspeed's VP, Chief Information Security Officer (the "CISO"), with over 25 years of experience in Fortune 500 companies including in aspects of IT, infrastructure, information security including multiple CISO roles, and certifications across IT and information security, leads our InfoSec GRC organization and is responsible for the implementation, operation, and monitoring of our cybersecurity risk management program. Our CISO reports to the CIO, who reports to the Chief Executive Officer.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights in order to adhere to industry standard practices. Our collaboration with these third-parties includes regular audits, risk and vulnerability assessments, and consultation on security enhancements.

companyName: WORKIVA INC

ticker: WK


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: PEPSICO INC

ticker: PEP


text: The Company's information security program, led by our CTO and Deputy CISO, collaborates with various departments within the organization, such as information technology, legal, enterprise risk management, human resources, accounting, finance, and internal audit, as well as external third-party partners. This collaboration aims to identify, mitigate, and plan for potential cybersecurity threats comprehensively. Additionally, the Company consistently evaluates and enhances its processes, procedures, and management approaches in response to evolving cybersecurity landscapes.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Kemper's information security program is an element of the Company's broader Enterprise Risk Management ( ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company's Enterprise Risk Committee ("ERC"), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company's ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.

companyName: KEMPER Corp

ticker: KMPR


text: Cybersecurity Risk Management and Oversight Strategy for Management of Cybersecurity Risk Cybersecurity protection and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud and violation of privacy or security laws.

companyName: Celanese Corp

ticker: CE


text: The CTO has served in various roles in information technology and information security for over 25 years. The CTO holds a PhD in engineering and degrees in technology and management. The CISO has served in various roles in information technology and information security for over 25 years, including serving as a cybersecurity leader for public companies for more than 10 years. The CISO holds a degree in engineering and a master's degree in business.

companyName: nVent Electric plc

ticker: NVT


text: MetLife also works with third parties, such as independent assessors (for example, for industry maturity assessments, penetration testing, application security reviews, and independent audits), external legal counsel and other consultants as part of the design and implementation of the Program. The Program is periodically evaluated by external experts, and the results of those reviews are reported to the Board of Directors.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: We maintain a comprehensive cybersecurity program which is integrated within the Company's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, and others. We also consume threat intelligence from several paid and non-paid sources.

companyName: CATERPILLAR INC

ticker: CAT


text: The audit committee maintains a cybersecurity sub-committee that is comprised of our Chief Information Officer ("CIO"), our Chief Information Security Officer ("CISO"), and representatives from the audit committee and board of directors that have knowledge and experience in cybersecurity matters. The cybersecurity sub-committee reviews our cybersecurity risk assessments and the steps being taken to monitor, control, and report on those risks as well as discusses regulatory and market developments. They also review our process for identifying and responding to cybersecurity incidents in a timely manner, and details of cybersecurity attacks or incidents which have occurred.

companyName: lululemon athletica inc.

ticker: LULU


text: Our Information Security Department performs annual risk assessments to evaluate the effectiveness of the controls as set forth in the Information Security Program to support the requirements under Gramm-Leach Bliley Act (GLBA), and Federal Financial Institutions Examination Council (FFIEC) Guidance on Securing Customer Information. The focus areas include: • technology systems used for information that is collected, processed and stored; • assessing internal and external cybersecurity threats and vulnerabilities; • performing regular penetration and controls testing; • evaluation and assessment of impact should the information or systems become compromised; • evaluation for the effectiveness of the governance structure for Information security risk management.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to security incidents related to our and our third-party vendors' data and systems. For more information, please see the risk factor entitled "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A - Risk Factors.

companyName: IROBOT CORP

ticker: IRBTQ


text: Although none of the members of the Audit Committee has any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee works closely with members of management and NTIC has engaged third-party service providers to further enhance its cybersecurity efforts and the oversight thereof by the Audit Committee.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1)

companyName: Nu-Med Plus, Inc.

ticker: NUMD


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • Our business and operations would suffer in the event of system failures; and • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: To date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected, or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While our insurance covers certain cybersecurity related matters, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: We engage third-party service providers in various capacities to enhance our internal cybersecurity capabilities. The Company engages consultants to assist with cybersecurity assessments, including with respect to cloud security and network vulnerability testing. Internal Audit, along with other internal stakeholders, including IT, determine the Company's need for cybersecurity assessments in conjunction with an annual cybersecurity risk assessment process.

companyName: Valaris Ltd

ticker: VAL


text: Our CIO has over 30 years of experience in technology. He was appointed as our CIO in January 2022, after serving as SVP Enterprise Systems for approximately five years. Prior to that, he was Global Head of Business Systems & IT at LivePerson for approximately six years. Our CIO is certified by Oxford University for Cybersecurity for Business Leaders.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: We recognize that a successful cybersecurity incident could lead to disruptions in operations, financial loss, reputational damage, and potential legal and regulatory consequences. The Company has a fully implemented incident response program, and internal forensics capabilities with third party forensic experts on retainer. We also maintain business continuity and disaster recovery plans so the Company can more effectively respond to cybersecurity incidents. It is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: Bancorp, Inc.

ticker: TBBK


text: We have an established incident response and recovery plan based on the NIST cybersecurity framework. The plan specifies the process for identifying, classifying, documenting and responding to cybersecurity incidents, including escalation protocols to ensure the involvement of our executive leadership, including our CEO, CFO, CIO and General Counsel so that decisions regarding the public disclosure and reporting of any incident can be made by executive management in a timely manner.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: We have developed and continue to enhance our cybersecurity risk management program as we seek to protect the security of our computer systems, software, networks and other technology assets against unauthorized attempts to access confidential information and data or to disrupt or degrade business operations. Our cybersecurity risk management program has evolved based on the changing needs of our business, the evolving threat environment and FHFA regulatory guidance.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of artificial intelligence. We have not experienced cyberattacks in the past, and there can be no guarantee that in the future such cyberattacks will not be material. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has delegated this cybersecurity risk management oversight function to our audit committee. Under the purview of our audit committee, our President and Chief Operating Officer, General Counsel, and Chief Financial Officer ("CFO") collectively, the "Risk Management Committee") are primarily responsible for assessing, managing and mitigating our critical risks from cybersecurity threats. Our Head of Information Technology ("IT"), who reports directly to our CFO, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Head of IT possesses approximately 19 years of experience with information technology and cybersecurity risk management programs. Our Head of IT's responsibilities, with support from our internal IT team and external IT consultants, include assessing, monitoring, and managing our cybersecurity risks.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: We consider cybersecurity protection, including protection of customer, employee, and partner information, to be a priority in the Company's business, strategy, and management. Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.

companyName: CARVANA CO.

ticker: CVNA


text: Our Chief Technology Officer, Information Security Officer, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of our management's Information Technology Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. Such individuals have experience in various roles for public companies involving managing information security, managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements. The Security Committee meets at least quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.

companyName: Paysign, Inc.

ticker: PAYS


text: A cornerstone of our cybersecurity governance is the annual performance of comprehensive cybersecurity risk assessments. These assessments evaluate our defenses against the latest cyber threats and vulnerabilities and support our preparedness to respond to evolving cyber risks. The insights gained from these assessments inform our ongoing efforts to review and refine our cybersecurity strategies, policies and defense mechanisms. As a core component of our risk management process, all employees are required to participate in annual information security training.

companyName: Urgent.ly Inc.

ticker: ULY


text: The Company's Internal Audit function performs audits to evaluate and report on compliance with cybersecurity policies and procedures, reviews internal control certifications from relevant third-party service providers, and tests IT system and network controls as part of its annual assessment of the effectiveness of the Company's internal controls. Additionally, the Company engages third-party specialists to conduct periodic tests, incident simulations and assessments to verify and continuously enhance its cybersecurity risk management program.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: CMS Energy and Consumers have experienced no material cybersecurity incidents; however, future cybersecurity incidents could materially affect their business strategy, results of operations, or financial condition. For additional details regarding these and other uncertainties, see Item 1A. Risk Factors.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: We actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats we discover or that are reported to us, and reports and services that identify threats. We monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases. We also have a bug bounty program.

companyName: Snowflake Inc.

ticker: SNOW


text: The Company's information security and cybersecurity program is managed by our CIO whose team includes a VP of Infrastructure and Director of IT Security (collectively, "the IT Security Team"), whom all have the necessary expertise, certifications and experience to lead our enterprise-wide cybersecurity strategy, policy, architecture and processes. The CIO has over 26 years of experience and has been a member and leader of our Company's information systems and technological advancements for the past 22 years. The Director of IT Security, reporting to our VP of Infrastructure, is responsible for our overall network security and assessing and managing cybersecurity risks and threats. The Director of IT Security has over 16 years of experience working in IT security and holds CISSP and GIAC certifications. The VP of Infrastructure reports to our CIO, and has principal responsibility for our network infrastructure and the operation of our cybersecurity program, network and system administration. The VP of Infrastructure has over 30 years of experience in system administration and has specialized in ERP systems and network infrastructure. Collectively, the IT Security Team prepares updates and presentations for the Board of Directors, Audit Committee and executive management.

companyName: H&E Equipment Services, Inc.


text: We face a number of cybersecurity risks in connection with our business. We have in the past experienced threats to and breaches of our data and systems, including ransomware, malware and computer virus attacks, including a ransomware attack in 2021 which had a material adverse impact on our business strategy and results of operations in 2021. For more information about the cybersecurity risks we face and have experienced, see the risk factor entitled " We have experienced a cyber security breach in the past and may be vulnerable to future security breaches, data privacy, and other information technology failures that could have a material adverse effect on our financial performance and operating results and disrupt our operations" within Item 1A- Risk Factors.

companyName: Sinclair, Inc.

ticker: SBGI


text: We will continue to monitor and assess our cybersecurity risk management program as well as seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled " Risk Factors " in Part I, Item 1A of this Report.

companyName: Zeo Energy Corp.

ticker: ZEO


text: With the guidance of the Audit & Risk Management Committee (the "Committee"), our board of directors is responsible for our risk management framework, including our strategy, policies, procedures and systems with respect to cybersecurity and information technology risks associated with us and our supply chain, suppliers and service providers. Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Tamboran Resources Corp

ticker: TBN


text: We train employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: We face cybersecurity threats in the ordinary course of our business and have faced cybersecurity threats and breach attempts in the past. Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems. The Company has processes in place to oversee and manage these risks. We have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to our use of key third-party service providers.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: We believe cybersecurity is critical to our mission to help every person live their healthiest life. Our customers, members, partners, and employees trust Accolade to maintain a secure environment for their health information. We process and maintain sensitive data on our customers and members in the form of PHI and PII and we maintain intellectual property of our solutions and PII of our employees. Because of the sensitivity of this data, we are subject to various cybersecurity threats that could adversely affect our business, customers, and members through impacts to the confidentiality, integrity, and availability of our systems.

companyName: Accolade, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factors— We and our collaborators, CROs and other contractors and consultants depend on information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."

companyName: ARDELYX, INC.

ticker: ARDX


text: Cybersecurity risk governance has been delegated by our Board of Directors to the Audit Committee of the Board of Directors, or the Audit Committee. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing, assessing, and considering, in consultation with management and the Board, as appropriate, the overall risk management policies and procedures of the Company, including our major risk exposures such as cybersecurity.

companyName: Prime Medicine, Inc.

ticker: PRME


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with executive leadership, the Company's ERM function, and the Company's Vice President of Information Technology. Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to executive management, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security approach, and make the necessary changes to address such findings.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: We provide mandatory training for our personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control envir onment and operating effectiveness. We report the results of these assessments, audits and reviews to the ISSC, the audit committee, and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance—We maintain cyber insurance coverage.

companyName: Redfin Corp


text: The SIRP provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. The incident response plan is reviewed, updated and tested at least annually. The SIRP covers the major phases of incident response process, including preparation; detection and analysis; containment and investigation; where required, notification to federal or state regulators; eradication and recovery; and incident closure and post-incident analysis.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Management plays an important role in assessing and managing our material risks from cybersecurity threats. Our Vice President – Information Technology (Chief Information Officer) is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. He has over a decade of experience leading cybersecurity oversight, and leads other members of our information security team, who have professional cybersecurity experience, training, or certifications.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses," "Item 1A. Risk Factors – Operational Matters – We are subject to third-party information system and other operational risks due to our reliance on third-party vendors and suppliers and the outsourcing of certain of our business operations" and "Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes through various penetration testing and best practice reviews. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We are aware that cybersecurity is a continually changing landscape and as a result, the engagement with these experts helps us evaluate our risk-based processes with respect to the trends.

companyName: Neuronetics, Inc.

ticker: STIM


text: Our information security program devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security program leverages the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) 27001 frameworks choosing to organize our cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST and ISO frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: The security of personal data is of the utmost importance to GoPro and our customers, vendors, suppliers, and employees. As such, we have implemented industry-standard administrative, technical, and physical security measures to protect against the unauthorized access, destruction, or alteration of our confidential and proprietary information and customer and employee information.

companyName: GoPro, Inc.

ticker: GPRO


text: Management assesses and considers cybersecurity risks through its enterprise risk management program, consultation with external advisors, as well as through discussions with our CIO and CISO. We have an experienced and dedicated CISO, who has served in various roles in information technology, technology audit and security over the past 38 years, including serving as a senior partner in charge of various information security and business resiliency practices at one of the Big 4 Accounting consultancies, advising some of the largest public company leadership teams and boards of directors on cyber related issues and projects. The CISO also served as the CISO for one of the Big 4, as well as a retail ecommerce business virtual CISO. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional certification of Certified Information Systems Auditor.

companyName: FIVE BELOW, INC

ticker: FIVE


text: As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Security Officer ("CSO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We are also participants and subscribers in industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: Digital Media Solutions, Inc.


text: Our Chief Information & Technology Officer along with our Vice President of Cybersecurity & Cloud Infrastructure provide principal oversight and guidance of our cybersecurity risk management strategy, programs and processes. The Chief Information & Technology Officer has over 20 years of experience in information technology in the real estate sector, leading organizations through strategic technology and process improvement initiatives. The Vice President of Cybersecurity & Cloud Infrastructure has over 15 years of extensive experience in cybersecurity and information technology. They are supported in their efforts by a team of technical experts who have had formal training and possess relevant industry related experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.

companyName: JBG SMITH Properties

ticker: JBGS


text: The Audit Committee oversees cybersecurity risks and incidents, ensuring compliance with disclosure requirements and cooperation with law enforcement. Senior management regularly updates the committee on cyber risks and any material incidents.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives updates as needed from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: SELECTIS HEALTH, INC.

ticker: GBCS


text: The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company's independent assessor provides a periodic assessment of the Company's risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company's adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company's technological environment. The Company has engaged an independent security assessor to evaluate the Company's cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The Board, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the Executive Director of IT.

companyName: Passage BIO, Inc.

ticker: PASG


text: The Company's policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks. The controls are developed based on risk assessments and a review of controls from multiple security frameworks, such as the Center for Internet Security's Critical Security Control and the Payment Card Industry Data Security Standard. The Company, internally and through third parties, conducts multiple information risk assessments each year. Risks identified in such assessments are considered and evaluated for inclusion in the Company's information risk portfolio and are then prioritized and addressed where appropriate to update the Company's information security programs. Assessments, along with risk-based analysis and judgment, are used by the Company to determine how it should manage these risks.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: We maintain a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity and availability of our information systems. Dedicated security, privacy, information governance and compliance professionals administer the program with oversight by our senior management team.

companyName: FLUOR CORP

ticker: FLR


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer ("CIO"). Our CIO has been in the role since May 2021, and has 30 years of experience in technology risk management and cybersecurity, primarily within the financial services sector.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors".

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our preventive and detective security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to members of management, the Audit Committee, which is comprised solely of independent directors, and the Board, when necessary. Throughout the year we do vulnerability testing. We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on industry best practices, vulnerability assessments, cybersecurity threat intelligence, input from consultants, and incident response experience.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: AMETEK's cybersecurity risk management practices are based on the widely recognized National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (The NIST Cybersecurity Framework and the NIST 800-171 Revision 2 Standard). This guidance was developed with private sector input and provides a framework and toolkit for organizations to manage cybersecurity risk.

companyName: AMETEK INC/

ticker: AME


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff, or external experts as part of the Board 's continuing education on topics that impact public companies.

companyName: Douglas Emmett Inc

ticker: DEI


text: Collaboration with third-party cybersecurity experts for conducting penetration testing; vulnerability assessments and providing support in the triage of any cybersecurity event; and Select processes to review and manage the risks associated with third-party service providers.

companyName: URBAN ONE, INC.

ticker: UONE


text: We rely on our indirect sales channel partners and supply chain to deliver our products and services to our customers, and a cybersecurity incident at a channel partner, supplier, subcontractor or joint venture partner could materially adversely impact us. We also contractually flow cybersecurity regulatory requirements to our subcontractors in alignment with legal and contractual obligations. Extensive international law and US-sector specific laws pertaining to privacy and data security may create challenges for our supply chain and increase costs as we continue to flow down legal obligations.

companyName: Altair Engineering Inc.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management promptly updates the Committee regarding any material cybersecurity incidents, and as necessary as to any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: CADIZ INC

ticker: CDZI


text: As discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business. Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.

companyName: WEWARDS, INC.

ticker: WEWA


text: Our industry is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the section titled "Risk Factors—Risks Relating to Regulation" for additional information regarding the risks related to cybersecurity threats.

companyName: Marqeta, Inc.

ticker: MQ


text: Our Enterprise Risk Management Committee performs a central function in the assessment and management of our important business risks overall. Our Enterprise Risk Management Committee is comprised of members of our executive leadership. The committee meets periodically to review risk-related topics, including updates on cybersecurity risks and incidents, cybersecurity policy changes, and certain cybersecurity investment recommendations. The diverse skills and experience relevant to cybersecurity risk management possessed by the senior management and executive positions on this committee contribute to our effective management of such risks. The Enterprise Risk Management Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through its Cybersecurity Steering Subcommittee and the Global Security Organization.

companyName: Informatica Inc.

ticker: INFA


text: We have an employee education program that includes annual training designed to raise awareness of cybersecurity threats, and we require employees to review and acknowledge our IT Security Policy on an annual basis. Additionally, we have adopted an IT Incident Response Plan that outlines the procedures to be followed in response to a data breach, whether internal or through a third-party, that are designed to help contain, assess, and respond to the incident and mitigate potential harm.

companyName: Savara Inc

ticker: SVRA


text: The IT Security Team is responsible for the strategic oversight of cybersecurity risk management and strategy including the identification and assessment of cybersecurity threats and incidents. Periodically, the Company's VP of Business Operations and Strategy is also responsible, alongside the Chief Financial Officer (" CFO ") and senior management, to keep the Audit Committee of the Board of Directors informed and briefed with respect to cybersecurity risks and risks. Our VP of Business Operations and Strategy has extensive experience of over 20 years in various IT roles across a range of cyber technologies, processes and strategies and is supported by the IT Security Team and the wider IT team, to support the Company's cyber risk management processes, including the prevention, detection and mitigation of cybersecurity threats and incidents, and any required response to and remediation of such cybersecurity threats or incidents.

companyName: USA Rare Earth, Inc.

ticker: USAR


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Cytokinetics engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes periodic audits, threat assessments, and consultation on security enhancements.

companyName: CYTOKINETICS INC

ticker: CYTK


text: State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments where our customers are located.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: Our CIO and CISO are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: Veritone, Inc.

ticker: VERI


text: This structured overview distills the essence of the cybersecurity risk management and governance processes within the Company, emphasizing the proactive approach to cybersecurity management and the involvement of leadership at all levels.

companyName: i-80 Gold Corp.

ticker: IAUX


text: We have a dedicated cybersecurity team led by our Vice President of Information Security ("CISO"), who reports on cybersecurity directly to our Chief Technology Officer ("CTO"), who reports to our Chief Financial Officer ("CFO"). Our CISO has significant experience in cybersecurity and IT compliance, is a member of InfraGard, a national non-profit organization serving as a public-partnership between U.S. businesses and the Federal Bureau of Investigation, and is a member of the Cal Poly Pomona Cyber Security Advisory Council. He has also obtained the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), and Certified Chief Information Security Professional (CCISO). Our CTO has over two decades of experience in establishing, administering, and enhancing effective cybersecurity programs for multiple publicly-traded companies. Our CTO and CISO conduct quarterly cybersecurity reviews for our Chief Executive Officer ("CEO"), CFO, and Chief Legal Officer ("CLO").

companyName: American Homes 4 Rent

ticker: AMH


text: As of December 31, 2023, the Company had not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future, especially in light of the continuing efforts of sophisticated hackers to develop new means, and more effective versions of existing means, accessing and fraudulently exploiting companies' computer and network systems and communications systems. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."

companyName: Value Exchange International, Inc.

ticker: VEII


text: Management is responsible for hiring and overseeing third-party vendors related to cybersecurity and integrating cybersecurity risk considerations into our overall risk management strategy. Our internal cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances and reporting to the Audit Committee for certain cybersecurity incidents, which also allows decisions regarding the public disclosure and reporting of such incidents to be made by management, the Audit Committee and the Board in a timely manner.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: to Board of Directors Significant cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.

companyName: Toppoint Holdings Inc.

ticker: TOPP


text: Following these risk assessments, if needed, we evaluate whether and/or how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We do not yet have an IT manager given our limited exposure to risks, and therefore the review of our limited systems is undertaken by our President to manage the risk assessment and mitigation process. When applicable to our corporate structure and when we believe exposure to risks within our systems exceeds the current limited levels of exposure, we will monitor and test our safeguards and train our employees on the implementation of such safeguards, in collaboration with human resources, IT, and management, as available. We aim to promote a company-wide culture of cybersecurity risk management as we grow in size.

companyName: GROOVE BOTANICALS INC.

ticker: GRVE


text: Board of Directors The Audit Committee of the Company's Board of Directors oversees the effectiveness of the Company's internal controls, including controls designed to identify, mitigate, and assess potentially material cybersecurity threats and incidents. The Audit Committee is informed of the status of the cybersecurity risk management processes by management during regular Audit Committee meetings. Reports from management include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: Our CEO and CFO are responsible for assessing and managing our material risks from cybersecurity threats, our overall cybersecurity risk management efforts, and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: The Bank's Technology and Operations Committee is responsible for approving the Bank's cyber incident response plan and other technical processes and standards to implement the policies and procedures defined in the Cybersecurity risk management program. The Risk Management function is responsible for management of operational risk and implementation of the cybersecurity risk management framework within the Risk Management Program as approved by the Board.

companyName: Federal Home Loan Bank of New York


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. Commencing in 2024, our Audit Committee, on behalf of the board of directors, provides oversight of our cybersecurity risk management program.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats. We also use third party security tools to help identify, assess, mitigate, and remediate cybersecurity threats; however, we cannot guarantee that any third-party tools that we utilize will be successful in all circumstances, and whether such tools are appropriate for their level of risk.

companyName: Beauty Health Co

ticker: SKIN


text: Risk Management and Strategies We regularly perform evaluations of our security program and continue to implement controls aligned with industry guidelines to identify threats, detect attacks and protect data. Our risk management strategy is focused on three areas: (i) technology, being our hardware and software systems; (ii) processes, being our cybersecurity reporting, testing and other processes; and (iii) people, which refers to our internal cybersecurity personnel, external service providers and individual training and human interaction within our information technology and cybersecurity processes. We seek to align our cybersecurity program with practices recommended under ISO 27001 and by the National Institute of Standards and Technology and the Center for Internet Security Critical Security Controls.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: At the management level, our Senior Vice President of Information Technology, who has extensive cybersecurity knowledge and skills gained from over 19 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to our Chief Financial Officer.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: EOG has implemented and invested in multiple technologies, controls, and procedures designed to protect its information systems and related infrastructure; identify, assess and remediate vulnerabilities; and monitor and mitigate the risk of data loss and other cybersecurity threats and intrusions.

companyName: EOG RESOURCES INC

ticker: EOG


text: During the fiscal year ending December 31, 2023, we incurred $5.4 million in response costs related to the incident, including professional services and legal fees, before insurance recoveries. We currently do not expect to experience material expenses and costs associated with our response to this cybersecurity incident during the 2024. While a loss from these matters is possible, we are unable at this time to reasonably estimate the possible loss or range of loss. Therefore, no liability for losses has been recorded related to the incident as of December 31, 2023.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: During the year ended December 31, 2024, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: QHSLab, Inc.

ticker: USAQ


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data"). We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially affected or are reasonably likely to materially affect our operations or financial standing.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Assessing, identifying, and managing material risks from cybersecurity threats We are committed to maintaining robust cybersecurity practices to safeguard our information assets and ensure the confidentiality, integrity, and availability of our operations. We employ a comprehensive approach to assess, identify, and manage material risks arising from cybersecurity threats. The identification and oversight of material cybersecurity risks is included in continuous Enterprise Risk Management (ERM) Committee and Board of Directors meetings and reporting.

companyName: LITHIA MOTORS INC

ticker: LAD


text: As of February 27, 2025, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the Partnership, including our business strategy, results of operations or financial condition. However, there can be no assurance that MPC's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that cybersecurity incidents may occur and could have a material adverse effect on our business strategy, results of operations, or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: MPLX LP

ticker: MPLX


text: Cybersecurity is an important part of our risk management program for our Board and management. The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through directory-based identity-related services for operation account security, firewall policies and periodical vulnerability threat scanning for network security and email-layer and endpoint-layer protections for data integrity on systems and user devices.

companyName: FGI Industries Ltd.

ticker: FGI


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Vice President of IT and our Security and Compliance Engineer. Our Vice President of IT and Security and Compliance Engineer have served in various roles in information technology and information security for over 30 years and bring a wealth of expertise to their roles. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: CHUY'S HOLDINGS, INC.


text: Although management is responsible for the firm's day to day cybersecurity operations, the Board of Directors oversees the firm's cybersecurity program. The Board does not delegate this responsibility to a committee, nor does the Board identify a cybersecurity expert to consider the firm's activities and make recommendations or provide advice to the Board. Instead, many of our directors have significant technology experience gained through their prior work experience and through their positions on other boards of directors, all of which provides the Board with insight and practical guidance in overseeing the firm's technology and operations as well as our continuing investment in and development of our cybersecurity program.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: The Company's Senior Management team, including the CCO, is regularly informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, please see "Risk Factors – Cybersecurity, Data Protection and Technology Risks" in this annual report on Form 10-K.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: We recognize the importance of protecting both our information and operations from threats that could disrupt our business, put our assets at risk or compromise our customer and employee data. Our cybersecurity program is implemented and maintained using information security tools, policies and a dedicated team responsible for monitoring our networks, providing training to our employees, analyzing the evolution of new threats and strategies for mitigating such threats and seeking to continually harden our cybersecurity posture. The program is periodically exercised, reviewed, updated, and vetted through third-party audits, assessments, and tests with the goal of validating its effectiveness in reducing risk, as well as evaluating its compliance with legal and regulatory requirements. We assess, identify and manage our material risks from cybersecurity threats by employing the following: • Identification of critical systems – we seek to identify which operational or information technology, if compromised or exploited, would result in operational disruption or data compromise. We aim to protect the entire environment at an enterprise level where practical, combined with additional layered, risk-based controls designed to safeguard against cybersecurity threats. This strategic, defense-in-depth, and risk-based approach to cybersecurity provides a methodology designed to identify, protect, detect, respond, and recover from cybersecurity incidents. • Network segmentation – we use a combination of firewalls and routers to provide network segmentation seeking to provide us with network zone protection. • Access controls – we leverage several security capabilities to attempt to enforce access, authorization and authentication to relevant systems, technology, and controls. A least-privilege methodology is applied for localized client workstations, servers, and applications. Security capabilities for access control include physical, administrative, and technical controls that combine to provide a defense-in-depth approach designed to protect our cyber assets from unauthorized use. • Continuous monitoring, detection, and auditing – we employ various technologies, tactics, and procedures aimed to continuously monitor, baseline, and detect threats, and audit our network and systems. In addition, we use a combination of technology tools with outside managed security service providers designed to capture, analyze and respond to security anomalies. • Patch management – we use a network vulnerability scanning tool that continually scans, and reports identified vulnerabilities in servers and workstations in certain networks. Vulnerability scanner reports are used to drive patching and remediation efforts and are also used as a tool to evaluate the effectiveness of efforts to seek to ensure patches are applied timely. Application and infrastructure subject matter experts subscribe to various third-party vendor security notifications to receive proactive notifications on, among other things, bugs, security flaws and mitigations, related to operational and information systems.

companyName: Fat Brands, Inc

ticker: FATAQ


text: A critical component of the Fund's cybersecurity program is its incident response plan. This plan includes a requirement to evaluate the materiality of any data incident. Should the evaluation conclude that the data incident rises to the level of materiality it will be incumbent for the Fund, working with the Investment Adviser and legal and cybersecurity professionals, to describe the data incident within four business days of determining that an incident is material. The Fund shall also be responsible to provide ongoing reporting about the status of the material data incident until such time that the material data incident is no longer a factor with respect the Fund's operations.

companyName: Wellings Real Estate Income Fund


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response and reporting plan.

companyName: BOX INC

ticker: BOX


text: To date, cybersecurity breaches have not materially affected us. Notwithstanding our investment in cybersecurity, however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. For a discussion of cybersecurity risks affecting our business, see Item 1A - Risk Factors - Risks Related to Our Information Technology Systems.

companyName: Ingredion Inc

ticker: INGR


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: 7 Layer Solutions, a security auditor and advisor in systems administration and penetration testing; A-LIGN, a systems auditor and advisor for cybersecurity and compliance; Grant Thornton, an IT Systems auditor and assurance vendor; and KnowBe4, an email security and cybersecurity training partner. We also purchase insurance to protect us against the risk of cybersecurity breaches. Our General Counsel and CFO are responsible for our insurance programs and review our cyber insurance policies on an annual basis and assess whether we have appropriate coverage.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: We also maintain a formal Vendor Management Program that provides oversight of cybersecurity risks related to our vendor and supplier relationships. During vendor onboarding, we perform risk-based due diligence on these third-parties, with heightened requirements for vendors that have access to confidential or personal information or that require access to our information systems. This Vendor Management Program includes specific cybersecurity requirements for our vendors, as well as ongoing monitoring, assessment, and contract review. Members of the CCDC are involved in and review the Vendor Management Program at least annually.

companyName: Gold.com, Inc.

ticker: GOLD


text: Through established governance structures, including our problem and incident management process and incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Information Security Committee, or to the full Board, as appropriate.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Cybersecurity risks are considered as part of the risk management process across all levels of the organization but are also facilitated through a formal process in which the Company identifies significant risks through regular discussions with management and also develops responses and mitigating actions to address such risks. In conjunction with the Company's Internal Audit department, management compiles a report of significant, enterprise risks that is shared with the Company's Board of Directors and its Audit Committee annually or as needed. In addition, cybersecurity and information security risks are among the matters presented by the Chief Technology Officer ("CTO") for discussion with the Company's Board of Directors annually and its Audit Committee quarterly or as needed. The CTO, who reports to the Chief Financial Officer, is responsible for leading the assessment and management of cybersecurity risks. The Company's current CTO has more than twenty-five years of experience in IT across diverse industries, and he has designed and led the approach for the modernization of the Company's technology platforms and security posture since 2017.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: Management's Role Managing Risk While the ITSC and our Board of Directors to which it reports oversees cybersecurity risk management, management is responsible for the day-to-day cybersecurity risk management processes. The Chief Risk Officer ("CRO") and the CISO play a pivotal role in informing the ITSC and Board Risk Committee on cybersecurity risks. Comprehensive briefings are presented to the ITSC and Board Risk Committee on a regular basis, with a minimum frequency of quarterly. These briefings encompass a broad range of topics, including: Maturity of our cyber landscape commensurate to inherent risks of environment;

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: We have established and maintain comprehensive incident response and business continuity plans that address our response to, and mitigation and remediation of, a cybersecurity incident. We have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents to the ELT and the Audit Committee when appropriate, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: nVent Electric plc

ticker: NVT


text: The Board receives annual reports from management on our cybersecurity risks. In addition, management updates the Board, as appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Metsera, Inc.


text: Program Adjustments. The CIO and ISO monitor, evaluate, and adjust the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Cybersecurity holds a significant role within our risk management procedures and remains a focal point for our Board and management. Under the Board's oversight of general risk identification and management activities, the Audit Committee specifically monitors cybersecurity risks. Committee members engage in comprehensive discussions with management regarding these risks, as well as the measures taken to safeguard the company's information systems and security, along with reviewing management's steps towards data privacy protection. Additionally, the Audit Committee receives annual cybersecurity updates from senior management, covering both existing and emerging risks, management's responses and mitigation efforts, any cybersecurity or data privacy incidents, and the status of key information security initiatives. Furthermore, our Board members regularly hold informal discussions with management about cybersecurity news events and any updates to our cybersecurity risk management and strategy programs.

companyName: SPAR Group, Inc.

ticker: SGRP


text: As part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.

companyName: ImageneBio, Inc.

ticker: IMA


text: Our CISO is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The cybersecurity team collectively has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as information obtained from governmental, public, and private sources, including external consultants engaged by the Company on a real time basis. The Company is enhancing its processes for oversight of third-party vendors, including appropriate due diligence for new providers and continuous monitoring following implementation, including ongoing direct contact with vendor personnel. Third-party vendors are re-evaluated at regular intervals as part of our supplier qualification process.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The Company's cybersecurity program is overseen by its Chief Information Security and Privacy Officer (the "CISO"). The Company's CISO has over 25 years of experience in information security and technology governance, risk, and compliance, including a previous CISO position at a large regional bank. The Company's CISO has also held leadership roles in enterprise risk management and internal audit for large financial service organizations, as well as at a global audit, assurance, and advisory firm. The CISO meets quarterly with and chairs the Cyber ERM Committee, which consists of representatives from the officer of enterprise security, information technology, risk, compliance, and other internal stakeholders, and presents quarterly to the Enterprise Risk Management Committee ("ERMC"), which includes executive and senior leadership of the Company, and the Risk and Compliance Committee of the Board of Directors ("Board Risk Committee"). The management of risk from cybersecurity threats is one of the risks that is continuously assessed, monitored and managed by the Company under the Company's ERM framework which is described more fully in the Company's Annual Report to Shareholders. The CISO maintains a scorecard which monitors and measures various cyber risks, including: a. Operational capability, including cyber defense, vulnerability management, and third-party risk management. b. Risk assessments, including GLBA assessments and attack simulations. c. Program maturity, including the NIST Cybersecurity Framework (CSF) and the Federal Financial Institutions Examination's Council's (FFIEC) maturity framework. d. Internal and External Audit, including external assessments, internal audit results, and regulator exam results.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: Risks from Cybersecurity Threats While we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business, operations, financial condition or results of operations, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. See "Item 1A – Risk Factors – Technology, Cybersecurity and Privacy Risks – The failure to effectively maintain and modernize our technology systems and infrastructure and integrate those of acquired businesses could adversely affect our business", " – Technology, Cybersecurity and Privacy Risks – We could incur significant liability if our technology systems or those of third parties are breached or we or third parties otherwise fail to protect the security of data residing on our respective systems, which could adversely affect our business and results of operations" and " – Business Strategic and Operational Risks – Our inability to successfully recover should we experience a business continuity event could have a material adverse effect on our business, financial condition and results of operations " for more information.

companyName: ASSURANT, INC.

ticker: AIZ


text: An Incident Response Team that includes representatives from key areas of the Corporation meets in the event of cybersecurity incidents. This Team receives special training, including an annual tabletop exercise. The Team ensures the proper notifications are made to comply with all relevant laws, rules, regulations, and policies.

companyName: ENB Financial Corp

ticker: ENBP


text: Network Security Management. The security of the FNB network infrastructure is maintained via: • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks to control remote access to our network, • intrusion detection capabilities, • network access controls to prevent unauthorized assets from connecting to the network, and • web filtering.

companyName: FNB CORP/PA/

ticker: FNB


text: Our leadership team receives monthly updates on security operations and governance functions as part of monthly Information Security Council meetings led by our CISO. The Audit and Finance Committee of our Board of Directors oversees information security matters and the Company's cybersecurity program. Our Chief Information Officer and CISO report on cybersecurity related matters, including the status of ongoing initiatives, incident reporting, compliance with regulatory requirements and industry standards, and emerging threats in global cybersecurity, on a periodic and as needed basis to the Audit and Finance Committee. The Audit and Finance Committee offers guidance on certain matters and approval for material initiatives. In addition, the full Board of Directors is updated on cybersecurity matters as needed depending on the nature and materiality of a cybersecurity matter.

companyName: ALBEMARLE CORP

ticker: ALB


text: Our Chief Information Security Officer works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Security Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.

companyName: BOYD GAMING CORP

ticker: BYD


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Head of Information Technology and includes our Chief Financial Officer, Vice President of Legal and Business Development, and relevant business departments (the "Incident Management Team"). Our Head of Technology brings extensive experience in software development, IT, and cyber security, gained in over two decades in the consumer product and healthcare sectors.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We have implemented policies to ensure we can control and monitor all devices that may have access to our protected information. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. Our risk management, legal, and compliance personnel oversee and identify material risks from cybersecurity threats associated with our use of such entities.

companyName: Nxu, Inc.

ticker: NXUR