text: We have implemented and maintain a risk management framework designed to identify, assess, and mitigate risks from cybersecurity threats. We assess our cybersecurity program ("CSP"), as part of our enterprise risk management program, against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and also use as a model the Center for Internet Security ("CIS") control framework's Implementation Group 2 ("IG2"). We perform annual assessments against NIST CSF benchmarks and focus on continuous improvement over those criteria. We use a list of factors based on business risk tolerance and external compliance requirements to determine if a business asset, data, system, process, or service provider should be included within the scope of the CSP. Prior to contracting with an outside vendor that hosts our data, such as Company information, or PII of our associates or residents, or that integrates with our systems, our policy is to conduct a cybersecurity risk assessment, which includes, as appropriate, a due diligence questionnaire completed by the vendor, a System and Organization Controls 1 ("SOC1") report from major vendors and a review of the vendor's scope of access to our IT systems and data.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: We utilize third-party service providers as a normal part of our business operations. To address cybersecurity risks arising from our relationships with third-party service providers, we employ a vendor risk program. We monitor risks relating to potential compromises of sensitive information at our third-party service providers and re-evaluate the risks associated with our partners periodically. Prior to exchanging our data with third-party service providers, they are required to go through a vendor risk assessment. We also conduct third-party security reviews and evaluate their network, processes, and systems. In addition, we obtain annual attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.

companyName: lululemon athletica inc.

ticker: LULU

secItem: Item 1C


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.

companyName: Sabine Pass Liquefaction, LLC


text: One of the key functions of our board of directors, in connection with our IT team, is informed oversight of our risk management process, which includes risks from cybersecurity threats.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: Our management team, including our Senior Director of Infrastructure and Cybersecurity (20 years of cybersecurity risk management experience) and Chief Information Officer (five years of cybersecurity risk management experience), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes demonstrated expertise in cybersecurity, life sciences, and security industry certifications such as Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP).

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: We prioritize the management of cybersecurity risk and regularly assess any risk of cybersecurity threats. In doing so, we continuously monitor and test our information systems for potential vulnerabilities pursuant to our cybersecurity program. Our cybersecurity program, led by our interim Chief Information Security Officer ("CISO"), is part of our overall enterprise risk management program, along with other significant risks that we face.

companyName: Rithm Capital Corp.

ticker: RITM


text: Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Avenir Wellness Solutions, Inc.


text: Employee Training We endeavor to provide all employees with data protection training. Employees involved with information protection, privacy, and other risk management specialties also engage in specialized role-based training as is practicable. We use a variety of training methods, including computer-based training, role-based training, company intranet awareness campaigns, and various simulation exercises.

companyName: Chubb Ltd

ticker: CB


text: As one of the world's largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our customers. Our cybersecurity risk management program is an integral part of our overall Enterprise Risk Management ("ERM") program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Risk Assessment and Remedial Measures. The Company engages in periodic cybersecurity and technology resilience risk assessments based on methodology and guidance from a recognized national standards organization; and utilizes periodic risk-based analysis for adopting, maintaining and adjusting security controls to address such risks.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and security incidents across our business to remediate and resolve any such incidents. Significant incidents are reviewed regularly by our CTO, VP of Engineering, and head of IT to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment to the broader executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent registered public accounting firm of matters and any relevant developments.

companyName: Getaround, Inc


text: Additionally, in 2023, the Company established its CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.

companyName: APA Corp

ticker: APA


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.

companyName: Tradewinds Universal

ticker: TRWD


text: Our cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, our cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team, as well as the services of third-party consultants, to assess and evaluate the effectiveness of our controls (in alignment with the NIST framework) and to improve our security measures and strategy. The cybersecurity team has also engaged a third party to measure our cybersecurity program against the NIST cybersecurity framework. The results of this assessment confirmed the rigor of our cybersecurity risk management practices.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "The Company's business and operations would suffer in the event of computer system failures or security breaches " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors to monitor and respond to security threats via a 24/7/365 Security Operations Center. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: A-Mark's CIO chairs the CCDC. Our CIO brings over 15 years of IT experience to A-Mark. Since joining A-Mark in 2019, he has been pivotal in enhancing our data privacy compliance program, significantly strengthening our data protection and privacy measures, particularly ensuring protection of sensitive data. The co-vice chairs of the CCDC are A-Mark's Vice President of IT and JM Bullion's Vice President of Digital and Technology. Our Vice President of IT has over 25 years of experience in IT working in various industries including ecommerce, health care, and financial industries focusing on IT operations, cybersecurity and compliance. Since joining the company in 2014, he has been instrumental in the creation and growth of our cybersecurity program. Our Vice President of Digital and Technology at JM Bullion has comprehensive experience in the cybersecurity field. He successfully established a 24/7 security operation center (SOC) to continuously detect and respond to security incidents, as well as implemented various advanced services to proactively detect vulnerabilities on potential attack surfaces with high accuracy spanning across assets, applications, data, endpoints and network. He also centralized the workforce identity and access management (IAM) of the various systems for improved administration and control at the subsidiary level. He joined JM Bullion in 2015 and has served in his current role as Vice President of Digital and Technology since 2021.

companyName: Gold.com, Inc.

ticker: GOLD


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board of Directors has established robust oversight mechanisms and is willing to cause the Partnership to expend significant resources to further enhance digital security or to remediate vulnerabilities to ensure effective governance in managing risks associated with cybersecurity threats. The Board of Directors recognizes the significance of these cybersecurity threats to our operational integrity and stakeholder confidence.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is considered an integral part of our overall risk assessment process. For example, we report, review and consider results and findings from external and internal security and privacy assessments as part of our overall risk assessment process, and we analyze how cybersecurity risks interplay with operational, financial, compliance and reputational risks.

companyName: Compass, Inc.

ticker: COMP


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, consumers, employees and other stakeholders and oversees all cybersecurity matters. Management plays a central role in our information security program, which is a critical component of our enterprise risk management and includes the implementation of controls aligned with industry best practices and applicable frameworks to identify threats, deter attacks and protect our Company assets. In addition, we engage a range of cybersecurity experts, including cybersecurity auditors, assessors, and consultants, in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and ensure that our cybersecurity strategies and processes remain in line with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Monster Beverage Corp

ticker: MNST


text: The Sponsor recognizes the importance of managing cybersecurity risks to protect its business operations, clients, and stakeholders. The Sponsor has implemented a comprehensive Cybersecurity Policies and Procedures Plan for the Funds, which outlines our approach to identifying, assessing, and mitigating cybersecurity threats and vulnerabilities in alignment with industry standards and best practices.

companyName: VS Trust

ticker: SVIX


text: Our management team, including the Chief Information Officer ("CIO"), is responsible for identifying and managing our material risks from cybersecurity threats. The CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both the PECO cybersecurity team and our retained external cybersecurity consultants. The management team, led by the CIO and cybersecurity team, stay informed about cybersecurity risk including prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the PECO environment. The CIO works closely with members of PECO's cybersecurity team, who have years of experience working in cybersecurity, possessing industry certifications such as Certified Information Systems Security Professional ("CISSP") and Security+, and pursuing advanced degrees and studies in the field. Cybersecurity team members participate in recurring cybersecurity team meetings with the CIO and provide periodic executive leadership updates. The Audit Committee oversees our cybersecurity program and is periodically briefed by management, including the CIO, on cybersecurity risks and initiatives. In addition, management updates the Board, through the Audit Committee, as necessary regarding any significant cybersecurity incidents.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: Our cybersecurity program is led by our Vice President of Technology Innovation and includes a team of information technology professionals. The program is further strengthened through support of our General Counsel. These teams work closely together to support and bolster our cybersecurity program, which incorporates industry-standard frameworks, policies, and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity team informs our Audit Committee on information security and cybersecurity matters as needed.

companyName: Zomedica Corp.

ticker: ZOMDF


text: The Enterprise Risk and Return Council has delegated the power and authority to manage cybersecurity risks to the Information Security Council ("ISC"). The CISO chairs the ISC, with senior management representation from across the Company including representatives from Privacy, Legal and Technology. The ISC monitors, makes mitigating decisions about, and escalates information security risks that are outside the Company's established risk tolerance. Additionally, it provides executive sponsorship of information security controls and oversees the development and review of the information security policy and enterprise security standards.

companyName: ALLSTATE CORP

ticker: ALL


text: Key aspects of the Cyber Program include: • risk assessments designed to help identify material cybersecurity risks to critical systems and the company-wide information technology environment; • continuous monitoring of Company systems and the conduct of periodic penetration tests; • the IRP that includes procedures for responding to cybersecurity incidents; • required cybersecurity trainings for employees, incident response personnel, and Company management related to physical security of assets, data privacy and other information security policies and procedures; and • a third-party risk management process for its service providers, suppliers, vendors and other business associates.

companyName: PIONEER NATURAL RESOURCES CO


text: We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. We review our security plans and strategies as threats and conditions evolve. The following is a summary of our cybersecurity risk management and strategy processes:

companyName: TheRealReal, Inc.

ticker: REAL


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Interim Chief Financial Officer. This team is at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach includes regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment. Our third-party security expert consultant has over 30 years of experience with cybersecurity, information technology development and deployment, and information technology risk assessment and management, including information security management.

companyName: Onconetix, Inc.

ticker: ONCO


text: President and Chief Operating Officer is primarily responsible for assessing and managing material risks from cybersecurity threats on a day-to-day basis.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes and other means of attempted disruption or unauthorized access. Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice. Our relationships with third parties, including suppliers we manage, customers, and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not the direct target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties.

companyName: KELLY SERVICES INC

ticker: KELYA


text: e.a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and f.a third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Pursuant to our risk management policy, responsibility for the implementation of our risk management policy resides with the Chief Financial Officer. Management performs a periodic assessment (at least annual) of compliance, financial, IT, and fraud risks. Responses are consolidated and reviewed with management and the Audit Committee. The result of the risk assessment effort is leveraged to formalize management's operating effectiveness testing plan for the next year. The Audit Committee receives an update on the Company's risk management process, risk trends and any incidents at least annually from the management team. In the event of any incident, the Company expects to notify the Audit Committee immediately, or as soon as possible. For additional information regarding cybersecurity risks, see Item 1A "Risk Factors."

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: Our Board has delegated the primary responsibility for oversight of cybersecurity risk to the Audit Committee. The Audit Committee regularly reviews our cybersecurity and data security risks and mitigation strategies. At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security ("SVP-GIS") and our Executive Vice President and Chief Information Officer ("EVP-CIO"), and periodically receives reports and presentations from third parties. These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and cybersecurity considerations arising with respect to our peers and third parties. The Audit Committee reports to the Board on cybersecurity matters. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity and Technology Risks" included as part of our risk factor disclosures at Part I. Item 1A. Risk Factors of this 10-K.

companyName: CITIZENS, INC.

ticker: CIA


text: Our chief information officer and our security architect are responsible for day-to-day assessing and managing the cybersecurity risk and threats through internal assessment tools as well as third-party control tests, for audits and evaluation against industry standards and regulations. Our chief information officer has over twenty-five years leading IT and Cybersecurity teams and continually improve his expertise through cybersecurity classes and collaborate with cybersecurity professionals in hospitality industry.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Our safeguards include continuous network monitoring, complex passwords, team member training that reinforces our policies, standards, and practices, incident response capability reviews and exercises, and cybersecurity insurance and disaster recovery plans for the protection of our assets. The information security training and awareness program engages personnel through training modules on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all team members monthly, and is supplemented by companywide testing initiatives, including periodic phishing tests.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: Our Board of Directors and our Audit Committee oversee our Company-wide risk management, including cybersecurity risk. More specifically, our Audit Committee reviews with our management, at least annually, emerging cybersecurity developments and threats, the Company's risks relating to cybersecurity, including a review of the state of the Company's cybersecurity and the Company's strategy to mitigate cybersecurity risks. Our internal cybersecurity team consists of our Chief Financial Officer, our Director of Compliance, and our Information Technology department, which includes multiple security certified professionals. Each member of the team has assigned roles related to cybersecurity events. In the event of a cybersecurity attack, members of the cybersecurity team review records and details to determine the depth and materiality of the occurrence. Based on their analysis, appropriate disclosure of the event will be made.

companyName: ATRION CORP


text: The Board of Directors, as a whole, oversees the Company's risk management through both the Company's enterprise risk management program and the internal audit function. To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: The Company also maintains certain management committees that further assist in the prevention, detection, and mitigation of cybersecurity risks. Specifically, the CISO works closely with the Company's IT Steering Committee which, among other things, reviews the effectiveness of key controls and provides guidance around future initiatives that strengthen the Company's overall security posture. The IT Steering Committee is comprised of key executives such as the President and Chief Executive Officer and Chief Financial Officer, as well as senior employees that specialize in technology and information security, including the Company's CISO, Chief Technology Officer, and Chief Risk Officer, and representatives from the Board. This committee also monitors current events regarding cybersecurity threats to the Company and more broadly to the financial services industry to help the Company make informed decisions around any necessary internal control enhancements or adjustments. In addition to the IT Steering Committee, the IT Subcommittee assists the CISO to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. The IT Subcommittee typically meets quarterly and consists of members of the information technology and information security teams, the Director of Internal Audit, and senior management members of various business units. This committee is responsible for reviewing information technology and information security projects and the threat landscape.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Griffon relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company and with third parties. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade cybersecurity management program designed to assess, identify, protect, detect and respond to, and manage material risks from cybersecurity threats. To protect our information systems from cybersecurity threats, we use various information technology and cybersecurity tools to safeguard our systems and data, which help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: GRIFFON CORP

ticker: GFF


text: The role of the Board of Directors in our risk oversight process includes receiving reports from management and the chairs of Board committees on areas of material risk to our Company, including cybersecurity risks. The Board has delegated primary responsibility to the Audit Committee to review these matters. As established in the Audit Committee Charter, the Audit Committee oversees cybersecurity risks by reviewing reports, summaries and presentations on data management and security initiatives and significant existing and emerging cybersecurity risks. This includes material cybersecurity incidents, the impact to us and our stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents. Our VP of IT presents on risks from cybersecurity threats to the Audit Committee at least annually and to the full Board, as necessary.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: We have experienced no material information security breaches in the last three years. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. We also carry third-party cybersecurity insurance.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Information Technology Officer and Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 29 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.

companyName: FASTENAL CO

ticker: FAST


text: Our Board of Directors recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, as well as non-public information about our Company. Although the Board of Directors as a whole is ultimately responsible for the oversight of our risk management function, the Board of Directors uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for our cybersecurity risk identification and mitigation activities, and that Committee and senior management provide reports regularly to the Board of Directors.

companyName: Childrens Place, Inc.

ticker: PLCE


text: Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: The Company relies heavily on its information systems, and the availability and integrity of these systems is essential to conducting its business and operations. As a producer of oil and natural gas, the Company faces various security threats, including cybersecurity threats, to gain unauthorized access to its sensitive information or to render its information or systems unusable, and threats to the security of its facilities and infrastructure or third-party facilities and infrastructure, such as gathering and processing and other facilities, and pipelines. This risk may be heightened as a result of an increased remote working environment, similar to the one created by the COVID-19 outbreak in 2020. The potential for such security threats subjects its operations to increased risks that could have a material adverse effect on its business, financial condition, results of operations and cash flows.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: Our Vendor Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to maintain appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.

companyName: GUARANTY BANCSHARES INC /TX/


text: The execution and measurement of our cybersecurity program are managed by our Information Technology department. This program is integrated into our broader governance and internal controls framework. We regularly engage with third-party consultants, auditors, and specialists to enhance our program, employing advanced cybersecurity technologies and services to prevent, detect, respond to, and recover from cyber threats and incidents. Additionally, our third-party security partner actively monitors and mitigates risks from external sources as part of our overall cybersecurity strategy.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: We conduct regular third-party assessments of our cyber risk management program, and also conduct a periodic assessment of cybersecurity risk as part of broader enterprise risk management (ERM). This assessment includes an evaluation of the Company's processes to identify and respond to cyber risks and the effectiveness of the Company's lines of defense. Given the complexity and evolving nature of cybersecurity threats, we leverage both internal cyber analytics and external sources of threat intelligence to evaluate our cyber risks and to properly adjust our risk mitigation approach. We engage third parties to perform periodic assessment of our cyber program maturity against the NIST framework, to perform penetration testing, and to audit our capabilities from time to time. We also maintain controls and procedures that are designed to evaluate cyber risks on an ongoing basis. These processes include prompt communication of certain cybersecurity incidents to the Company's executives, internal committees and the Board as needed, so that any needed external reporting can be made by management and the Board in a timely manner.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: • Third-Party Experts. In addition to our internal cybersecurity risk management practices, we engage third-party experts to provide independent, external assessments of our information systems and security controls. These assessments address various regulatory requirements, take into consideration internal- and external-facing information systems and include tabletop exercises and technical system reviews related to security preparedness and response capabilities. • Third-Party Service Providers. We rely on third-party service providers to support our business operations and help execute our digital, restaurant technology and enterprise technology initiatives. Our contract review and onboarding process includes assessing third-party cybersecurity risk management practices and conducting data protection impact assessments for personal data processing that may result in high risk to individuals. Annually, we also review certain third parties' information security practices for compliance with contractual and regulatory obligations. • Incident Response Plan. We maintain an incident response plan that sets forth immediate response actions, internal and external communication protocols, stakeholder involvement based on the nature of the incident and post-incident analysis processes. The incident response plan designates an incident response team that is responsible for managing and executing response activities in coordination with subject matter experts and other stakeholders in the event of an incident. The incident response plan is supplemented by detailed incident management plans that outline the technical steps to be taken in response to certain types of incidents. We regularly conduct tabletop exercises and incident response plan testing to evaluate our incident response capabilities and readiness. • Annual Strategy Review. We annually review our cybersecurity risk management strategy to ensure it addresses changes in our business operations and the evolving cybersecurity threat landscape. This includes annual reviews of our incident response plan, as well as our information security, data classification and other Company policies and standards, reports to our Board of Directors and Board committees and detailed presentations to support the annual renewal of our system cyber insurance program. • Peer Involvement. We are active in the information security community, including as a core member of the Retail and Hospitality Information Sharing and Analysis Center ("RH-ISAC"), which represents more than 200 companies across retail and other consumer-facing industries. As a member of RH-ISAC, we benefit from real-time collaboration, industry specific benchmarking, threat intelligence reports and analysis, industry-relevant committees and working groups and numerous cybersecurity training, education and knowledge sharing opportunities. • Cybersecurity Insurance. We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company and the Wendy's system in the U.S. and Canada. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future incidents.

companyName: Wendy's Co

ticker: WEN


text: The Company uses a backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan ("IRP") in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors, as necessary. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: In case of a cyber incident, our cybersecurity team will maintain a cyber incident reporting and response process and will provide management notifications based on the seriousness of any incident. Management will provide periodic reports to our board of directors/audit committee on cybersecurity risks and steps that the Company has taken to address those risks. Our outsourced cybersecurity partner provides expert support in areas such as threat intelligence, vulnerability assessments, incident response and ongoing security monitoring. This collaborative approach allows us to leverage both internal oversight and external expertise to enhance our cybersecurity posture.

companyName: Odysight.ai Inc.

ticker: ODYS


text: The Company is developing processes and procedures to identify and oversee cybersecurity risks presented by third parties, including service providers, vendors and other users of the Company's systems.

companyName: BORGWARNER INC

ticker: BWA


text: The Audit and Finance Committee ("AFC") of our Board of Directors oversees information security matters and the Company's cybersecurity program. Our CIO reports on cybersecurity related matters, including the status of ongoing initiatives, incident reporting, compliance with regulatory requirements and industry standards, and emerging threats in global cybersecurity, on an as needed basis, but at least annually, to the AFC and executive leadership. The AFC and executive leadership offer guidance on certain matters and approval for material initiatives. In addition, the full Board of Directors is updated on cybersecurity matters as needed depending on the nature and materiality of a cybersecurity matter.

companyName: ALBEMARLE CORP

ticker: ALB


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and internal auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.

companyName: PIMCO Capital Solutions BDC Corp.


text: Our Program is supported by regular training of information security employees and awareness training and activities for executives, directors, and employees through which we communicate our cybersecurity policies, standards, processes and practices to foster a culture of cybersecurity risk management across the Company.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan (Incident Response Plan), which is administered by our Chief Information Security Officer (CISO) in close collaboration with our Director of Enterprise IT Risk. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents. The Incident Response Plan is intended to proceed on parallel paths in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business, communications, and risk personnel. Our incident response team annually performs exercises to simulate responses to cybersecurity events.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We believe that risks from cybersecurity incidents have not materially affected or are not reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats. Our administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls and identity verification. We also have policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test our team's response readiness capabilities.

companyName: TPG Inc.

ticker: TPG


text: Our Audit and Finance Committee, comprised fully of independent directors, is responsible for oversight of cybersecurity risk in connection with its oversight of the Company's enterprise risk management process.

companyName: MARATHON OIL CORP


text: Antivirus and Endpoint Detection and Response (EDR) solutions are deployed on all company computer assets, combined with Remote Endpoint Management for centralized monitoring and control.

companyName: DecisionPoint Systems, Inc.


text: Our Chief Information Security Officer and/or Chief Technology Officer provide quarterly briefings to the audit committee of our Board of Directors regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to our Board of Directors on such reports.

companyName: Yext, Inc.

ticker: YEXT


text: We face various cybersecurity risks and threats that could have a material adverse effect on our business, operations, financial performance, liquidity, and reputation. We have implemented processes and systems to identify, assess, and manage these risks and threats, as well as to prevent, detect, and respond to any cybersecurity incidents that may occur, which is integrated into our overall risk management process. We also have a comprehensive cybersecurity strategy, policy, and program that aligns with our business objectives and risk appetite. We regularly review and update our cybersecurity strategy, policy, and program to address the evolving nature and scope of cybersecurity risks and threats. In addition, we consider the cybersecurity practices of our third-party service providers, through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help identify and mitigate cybersecurity risks associated with those providers.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Our Board of Directors has adopted, and reviews annually, a Risk Appetite Statement that articulates the Company's attitude towards risk. The Company's Risk Appetite Statement identifies key risk categories and establishes a risk appetite for each, as well as specific associated risk metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and also identifies and regularly discusses emerging risks with the Risk Committee.

companyName: BANNER CORP

ticker: BANR


text: Our cybersecurity program is overseen by our Chief Information Officer, or CIO, and is managed by our CISO and other leaders from our information technology, or IT, and legal departments. Our CIO, CISO and Cybersecurity Manager have an average of over 20 years of prior work experience in various roles involving IT, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to senior management and the Audit Committee on any appropriate items.

companyName: iTeos Therapeutics, Inc.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by senior management and/or disclosure committee using processes that leverage subject-matter expertise from across the Company. Furthermore, we may engage third-party advisors as part of our incident management processes. Any cybersecurity incident that is identified as having the potential to be highly significant or material to the Company are brought to the attention of the Chief Technology Officer and /or General Counsel by the Chief Information Security Officer as part of our cybersecurity incident response processes.

companyName: Fisker Inc./DE


text: Management of Cybersecurity Risks The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans. We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams. Subsequent to the end of our fiscal year, our CIO left the Company and, in the interim, our Head of Cybersecurity currently reports to our CFO who reports to our Chief Executive Officer.

companyName: Capri Holdings Ltd

ticker: CPRI


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends, and remediation.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: Refer to Item 1A. Risk Factors under the heading "We rely on the integrity and security of our information technology systems, and our business could be materially adversely impacted by extended disruptions, significant security breaches or other compromises of these systems" for further information on the risks we face from cybersecurity threats. We believe that to date, such risks have not materially affected and are not reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: STEELCASE INC


text: In order to respond to the threat of security breaches and cyber-attacks, Prudential has developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, Prudential, including information related to the Company's operations and investments. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for Prudential's, the Manager's, their affiliates' and the Company's technological resources and includes training for employees, contractors and third parties. Employees of Prudential, as well as employees of the Manager and Subadviser, with access to Prudential's or its affiliates' systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: The Audit Committee of the Board of Directors oversees our cybersecurity program. It considers cybersecurity risk individually and within our overall risk management framework. We obtain periodic assessments of our information technology systems, including cybersecurity, the results of which assessments are reported to the Audit Committee. During meetings, our Vice President, Information Technology and executive leadership updates the committee on Acorda's cybersecurity posture, potential threats and risk mitigation strategies, and the progress of the Company's cybersecurity initiatives, as appropriate. The Chair of the Audit Committee and management provide regular briefings on such matters to the full Board of Directors, as appropriate.

companyName: Acorda Therapeutics, Inc.


text: Effects of Cybersecurity Risks on the Company To date, we are not aware of having experienced a material compromise of our systems or networks from a cybersecurity incident. However, we routinely identify attempts to gain unauthorized access to our systems. Additionally, some of our vendors and business partners have experienced compromises of their information systems, including systems that we use. On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing of our payment claims for all payors, notified us of a cybersecurity incident affecting some of its systems. In response to the incident, both we and Change Healthcare severed those business service connections between our systems and Change Healthcare's. We promptly conducted forensics on our systems based on the shared information regarding this Change Healthcare incident. As of February 28, 2024, we have not identified any compromise or unauthorized access of our systems or networks. The Change Healthcare incident has not affected our operations, except the submission of payment claims. At this time, we have not determined that this disruption to our submission of claims is likely to materially affect our business strategy, results of operation or financial condition.

companyName: Encompass Health Corp

ticker: EHC


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "If our information technology networks or data, or those of third parties upon which we rely, are or were disrupted or otherwise compromised, we could experience costly remediation or other expenses, liability under federal and state laws, and litigation and investigations, any of which could result in substantial reputational damage and materially and adversely affect our business, financial condition, results of operations, cash flows, and the market price of our common stock", for additional discussion about cybersecurity-related risks.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: As a multi-line insurance company, our business operations rely upon secure information technology systems for data processing, storage, and reporting. Despite security and controls design, such information technology systems could become subject to cyberattacks. Network, system, application, and data breaches could result in operational disruptions or information misappropriation, which could have a material adverse effect on our business, results of operations and financial condition. Unauthorized access to or unintentional dissemination of confidential, highly-sensitive customer, employee, or company data through breach in our facilities, networks, or databases, or those of our agents or third-party information technology and software vendors, could result in loss or theft of assets or operational disruption.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: The CISO and CTO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. The CISO has served in that position since 2018 and, was previously the Vice President, Head of Enterprise Security, Americas at Worldpay and a Security Principal/Strategist for Hewlett Packard Enterprises for a combined cybersecurity experience of 20 years. The CTO joined ADM in 2016 and was previously Senior Vice President and Chief Information Officer at Dow Corning Corporation for approximately 6 years.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cybersecurity matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts to accommodate for the ever-evolving information and cybersecurity threat landscape. The Information Security Officer ("ISO") regularly updates the Board, management and any appropriate committees on the information and cybersecurity risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: During the periods covered by this report, there were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company's operations, including third-party and client interactions, are increasingly done via electronic means, and this has increased the risks related to cybersecurity threats," which are incorporated by reference into this Item 1C.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: In the last three years, neither we nor our third party provider have experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. For additional information about the Company's cybersecurity risks, please refer to "Risks Related to our Technology and our Intellectual Property Rights" in Item 1A, "Risk Factors."

companyName: INSTRUCTURE HOLDINGS, INC.


text: The ISGC acts on the behalf of and to assist the Board of Directors and executive management in fulfilling its oversight responsibilities regarding the Bank's information security programs and risks. The ISGC is comprised of members from Risk, Information Technology, and other strategic areas within the Bank and meets at least quarterly. The responsibilities of the ISGC include providing strategic oversight and implementation guidance for the ISP, aligning cybersecurity and business objectives, monitoring and reporting on cybersecurity and information security incidents, and promoting a strong culture around information security.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: In the fiscal year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Lazard's cybersecurity program, which includes information security, is the primary responsibility of our CISO, who oversees our global information security strategy and program and is supported by our Information Technology and Information Security departments. The Company's current CISO has held the position since 2015 and has been working in technology risk management since 1991. The CISO holds a bachelor's degree from New York Institute of Technology and is an accredited Certified Information Systems Security Professional. Our CISO leads our Cybersecurity Incident Handling Team ("CSIHT"), to which cybersecurity threats and cybersecurity incidents are reported. The CSIHT manages the Company's response to cybersecurity threats and cybersecurity incidents, including the prevention, detection, analysis, containment, eradication and recovery thereof.

companyName: Lazard, Inc.

ticker: LAZ


text: Aviat's Board of Directors has oversight of the Company's cybersecurity risk as a component of its risk management. This includes prioritization of cybersecurity risks and the allocation of resources. The Board of Directors receives regular updates on the Company's cybersecurity program. The Board of Directors have delegated its responsibility for risk management oversight to the Audit Committee, which regularly reviews Aviat's cybersecurity program with the Company's management. The Company's management, including its Senior Director of Information Technology, Chief Financial Officer, and General Counsel, provide the Board of Directors updates regarding current and emerging cybersecurity threats, status of ongoing cybersecurity initiatives, certain incident reports and events, remediation efforts, and compliance with regulatory and industry standards.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: The Audit Committee is responsible for reviewing our disclosures on cybersecurity risk management, strategy and governance in our Annual Report on Form 10-K. The Audit Committee assists in determining materiality for timely reporting of cybersecurity incidents and is notified immediately if the incident response team has assessed that a material event may have occurred that may require filing an SEC Current Report on Form 8-K.

companyName: AtriCure, Inc.

ticker: ATRC


text: As part of our enterprise information security program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. In addition, we maintain incident response and recovery plans, the effectiveness of which is tested and evaluated on a regular basis. We also provide privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: MKS INC

ticker: MKSI


text: President and Chief Executive Officer and Senior Vice President of Finance oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Under such policies and processes, our President and Chief Executive Officer and Senior Vice President are responsible for reporting to our audit committee regarding any cybersecurity incidents.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: Discussion of Material Cybersecurity Risks and Incidents We have not experienced any material cybersecurity incidents in the past calendar years and the expenses we have incurred from cybersecurity incidents during that period were immaterial. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: The Information Security department is responsible for implementing and maintaining the Banks's Information Security program, which addresses cybersecurity risk management and cyber threats. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Financial Officer and with dotted-line reporting to the Audit Committee. Additionally, the CISO is a key member of the Technology Committee, which is charged with Bank's managerial oversight and steering organization for all information technology areas (including cybersecurity).

companyName: GUARANTY BANCSHARES INC /TX/


text: The program is evaluated and audited on an annual basis by independent third parties through ongoing IT compliance initiatives. Additionally, each year, we conduct cross-functional tabletop training exercises to rehearse our response to cyber-related breach incidents. We require that all employees complete cybersecurity trainings at least quarterly to mitigate cyber risks. We also randomly test employees with phishing simulations and provide periodic cyber and security updates. As part of the risk management program, we engaged external subject matter experts to develop a comprehensive third party and vendor due diligence program. This program strengthens our cybersecurity program by ensuring the establishment of contractual agreements and data protection clauses, documentation of processing activities performed as part of each service and identifies responsible process owners. Third parties and vendors with access to our information, systems and networks complete additional due diligence verification activities. All vendors with access to internal systems and networks must comply with our IT policies. Formal monitoring procedures of relationships with third parties are performed on at least an annual basis. This level of oversight allows us to maintain proactive visibility and security baseline requirements with our established external relationships.

companyName: Globalstar, Inc.

ticker: GSAT


text: Our cybersecurity program and supporting ISMS are governed by our Cybersecurity Steering Committee, which is chaired by our Chief Information Security Officer ("CISO") and is comprised of other members of our management team, including individuals from our finance, supply chain, product, information technology ("IT"), and legal departments. The Cybersecurity Steering Committee convenes quarterly to review the ISMS, identify new material risks and potential treatment plans that are recorded in our cybersecurity risk register, and review the overall health of security key risk indicators, technical key performance indicators, and roadmaps for the expected delivery of new and updated controls.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: maintaining oversight of our information security program by senior management, our board-level Technology and Information Security Subcommittee that reports to our board-level Risk and Compliance Committee and our Board of Directors; and maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, as needed. We had no material cybersecurity incidents in 2023.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: In order to manage technology risk and secure technology ecosystems, our information security framework is based on the National Institute of Standards and Technology ("NIST") principles, which we execute through our adherence to the Center for Internet Security ("CIS18") control framework. The CIS18 framework provides us the ability to align measurable controls to actions and benchmark against recognized standards. Using these recognized industry standards, we approach cyber risk management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks. Following our multi-pronged approach to protecting our systems and data, we: • administer monthly mandatory ongoing information security training for all employees throughout the year; • maintain privacy policy, security protocols and internal security controls; • use a zero trust network that verifies the device and user identity while restricting network access to only what is needed; • limit access to network resources to only devices that are owned and administered by the Company; • require multi-factor authentication for all employee user accounts; • maintain application-aware firewalls to limit cyberattack access to data; • use data breach detection software and a cybersecurity operations center that actively monitors our systems; • conduct internal technical cyber incident exercises with the information security team and our third-party cybersecurity service providers; and • conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address any deficiencies in our security program.

companyName: Meritage Homes CORP

ticker: MTH


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, to date, these incidents have not had a material impact on our financial condition or results of operations. In the event of a cybersecurity incident, we assess whether such incident had a material impact, and in certain cases, such assessment is reviewed by our leadership team, including the Chief Executive Officer, outside legal advisors and other third-party advisors. Refer to Item 1A. Risk Factors for further information regarding risk related to cybersecurity attacks and other breaches of our systems and information technology.

companyName: RYDER SYSTEM INC

ticker: R


text: We mitigate risks from cybersecurity incidents using a multi-faceted approach that includes, but is not limited to: establishing information security policies and standards, implementing information protection processes and technologies, assessing cybersecurity risk through vulnerability assessments and audits on an annual basis, reviewing newly developed cybersecurity standards or legislation, implementing cybersecurity training, monitoring our information technology systems for cybersecurity threats and collaborating with public and private organizations on best practices..

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: Our board of directors, led by the board's technology, innovation and operations committee, actively oversees our information security program, with our management, inlcluding the CIO and CISO, providing the board and that committee with regular updates (including at each of the three meetings held by that committee in 2024) and reporting on our IT strategy, including information security strategies and initiatives, event preparedness and incremental improvement efforts.

companyName: Essent Group Ltd.

ticker: ESNT


text: Our current DVP, Information Security has led the information security program at TaskUs for eight years, and has over a decade of prior experience in cybersecurity operations, risk assurance and internal audit. Additionally, he holds an MBA degree and multiple professional certifications including CISSP (certified information systems security professional), CISA (certified information systems auditor), CIA (certified internal auditor), CCSP (certified cloud security professional) and CRMA (certification in risk management assurance). The DVP, Information Security also leads our Information Security Council, which is composed of IT functional leads and is responsible for the quarterly review of cybersecurity risks and operations of the information security management system.

companyName: TaskUs, Inc.

ticker: TASK


text: We work to maintain a strong cybersecurity posture through a multi-layered approach. Our endpoint detection and response ("EDR") system helps monitor and analyze endpoint devices, and is designed to assist us in quickly identifying and responding to emerging threats. Complementing our EDR capabilities, our managed detection and response service assists with threat monitoring, proactive threat hunting, and rapid incident response. Furthermore, we employ data loss prevention tools to help enforce strict data security policies, prevent unauthorized access and protect the transmission of sensitive information. These integrated technologies help us to detect, mitigate, and respond to cyber threats, with the goal of minimizing potential disruptions to our business operations.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Busey maintains a cyber security risk management program designed to prevent, detect, and respond to information security threats. The program is designed to align with the Cyber Risk Institute's Profile framework, which is based on the National Institute of Standards and Technology's Cybersecurity Framework. The program is led by Busey's Chief Information Security Officer ("CISO"). Busey's CISO has been in the role since September 2020 and has over 15 years of experience across external and internal audit, technology risk management, and cybersecurity matters, spanning various industries primarily within the financial services sector, but also including healthcare, technology, consumer products, and manufacturing for both regional and multinational corporations. Busey's cyber security risk management program is a key part of the Company's overall risk management system, which is administered by the Chief Risk Officer.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Related to Cybersecurity Risks The Company's Global Director, Information Security (Security Director) directs the Company's cybersecurity team. He reports to the Company's Global Director of Information Technologies (IT Director), who reports to the Chief Executive Officer of the Company. The Security Director is responsible for assessing and managing the Company's cyber risk management program, informing senior management, as appropriate, regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts generally by the cybersecurity team. Our Security Director is a Certified Information Systems Security Professional (CISSP) and has over 20 years of experience in cybersecurity in a broad range of industries. Our IT Director has a master's degree in information systems and has prior experience managing global security efforts. Our Security Director manages a team of cybersecurity professionals with relevant experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and oversees management's design, implementation and enforcement of our cybersecurity risk management program, while our executive officers are responsible for the day-to-day management of the material risks. Our Board of Directors receive annual updates, and/or significant updates as needed, on relevant information regarding cybersecurity.

companyName: CYANOTECH CORP

ticker: CYAN


text: The full Board of Directors receives updates from the Audit and Compliance Committee on its oversight of cybersecurity risk on a quarterly basis or more frequently as needed. In addition, the full Board of Directors also receives periodic briefings from management on the digital risk and security program.

companyName: Premier, Inc.


text: We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including SOC 1, SOC 2, SOC 3, ISO 27001, 27017 and 27018, CSA STAR and others.

companyName: Salesforce, Inc.

ticker: CRM


text: Both Westlake's Chief Information Officer and its Chief Information Security Officer have extensive experience in assessing and managing cybersecurity risks, including through decades of collective experience in information technology and cybersecurity roles of increasing responsibility both at Westlake and in prior positions. Westlake prioritizes cybersecurity awareness among employees and contractors through various training exercises, including formal programs and simulated phishing events. Westlake maintains incident response plans, playbooks, and engages third-party cybersecurity firms for simulated cyberattacks and penetration testing to identify potential risks. Westlake also has a third-party cybersecurity firm on retainer for incident assistance and response. Periodic internal self-assessments are conducted by Westlake's cybersecurity organization using the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: The Company's cybersecurity program sets the framework for the Company's approach to cybersecurity. Each business segment of the Company designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under the Company's approach to cybersecurity, each business segment designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. The Company's cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Our engagement with law enforcement and regulators, and defense of litigation is ongoing. To assist our customers, we have offered identity protection services, including credit monitoring, to all of our current and former customers for two years.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.

companyName: EyePoint, Inc.

ticker: EYPT


text: The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the Bitcoin Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee, which has responsibility for overseeing the adequacy and effectiveness of our cybersecurity and information security programs and policies according to its charter.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: We have established an information security third party risk management program to identify and manage these risks. This program includes regular risk assessments, third party risk provider reviews, and implementation of security measures such as encryption and firewalls, and ongoing monitoring of our systems for potential threats. We also engage with industry consultants to assist with our risk assessments.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: Our cybersecurity program is managed by our chief information security officer ("CISO"). Our CISO is informed about and monitors awareness, prevention, detection, mitigation, and remediation efforts through regular communication and reporting from members of the information security team. Our CISO has served in global information security roles for over 20 years, including serving as the Chief Information Security Officer for a leading cloud-based security company and other organizations. In addition, our chief information officer ("CIO") has served in various leadership roles in the information technology field and has over 25 years of experience across multiple industries, including at adTech, semiconductor, consumer electronics, retail, software, and data companies.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: David Shear. Mr. Shear was appointed President International of RBI in January 2021. Mr. Shear previously served as President EMEA beginning in September 2016. Mr. Shear joined the predecessor of RBI in 2011, holding roles of increasing responsibility within Burger King U.S. marketing. He then held various roles in Asia Pacific, including serving as President of Burger King APAC from 2014 to 2016. Prior to joining Burger King, Mr. Shear worked at strategy consulting firm Charles River Associates.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Clarus Corp

ticker: CLAR


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024, and thru the date of filing of this Form 10-K.

companyName: PURE CYCLE CORP

ticker: PCYO


text: Vulnerability Management and Testing: We conduct regular vulnerability assessments and annual external penetration testing of our systems and applications to probe for weaknesses. We also perform periodic exercises simulating cybersecurity incidents to test our defenses and response procedures. Findings from these tests are used to strengthen our security posture on an ongoing basis.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: conducted penetration testing and remediated all issues identified; and enhanced e-mail filtering software to limit the possibility of phishing or ransomware attacks.

companyName: AGREE REALTY CORP

ticker: ADC


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; cyber insurance.

companyName: Leatt Corp

ticker: LEAT


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in "Item 1A. Risk Factors" of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in "Item 1A. Risk Factors" of this Form 10-K.

companyName: Coliseum Acquisition Corp.


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with internal information technology resources, other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluating, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.

companyName: MYOMO, INC.

ticker: MYO


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for certain service providers based on the Company's assessment of the providers' criticality to its business and the providers' cybersecurity risk profile.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: The Board oversees the management of risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity, which address a wide range of topics and also receives prompt and timely information regarding any cybersecurity incident that is or may become material, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology, who is the member of management that is principally responsible for overseeing cybersecurity at the Company, in partnership with other business leaders across the Company, including our Chief Executive Officer, Chief Accounting Officer, General Counsel, and Human Resources leader. Our Vice President of Information Technology has served in various roles in information technology and information security for over 28 years, including serving as Chief Information Security Officer of several public companies. He holds undergraduate and graduate degrees in electrical engineering and computer science and has attained numerous professional certifications in Information Security throughout his career.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: We have developed a cybersecurity incident response plan ("CSIRP") for cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Our CSIRP guides the internal response to cybersecurity incidents, following a process consistent with well-recognized industry cybersecurity frameworks. Pursuant to the CSIRP and its escalation protocols, we engage the incident response team ("IRT"), which includes designated personnel responsible for: (1) analyzing the severity of the incident and associated threat; (2) notifying management of the threat; (3) containing the threat; (4) eradicating the threat; (5) restoring data and access to systems; (6) working with management to determine the reporting and disclosure obligations associated with the incident; and (7) performing post-incident analysis and improvements. The IRT is led by an incident response coordinator, which in the event of a cybersecurity incident would generally be the CIO, and includes members of our IT resources, risk management, legal, communications, finance, and accounting teams, in addition to any other personnel depending on the particular facts and circumstances of the incident.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: At the day-to-day operational level, our CIO manages an information security team tasked with executing our cybersecurity program. This team includes a director of network security, technical director of enterprise architecture, system architects and network security staff. Members of our information technology (IT) management group, led by our CIO, have extensive years of combined experience in defending large, complex corporate environments. Our CIO, IT management group, architects and network security team members receive briefings and annual training on cybersecurity threats and response methods that provide real world threat scenarios to measure the effectiveness of our programs and technologies in protecting our systems. Our team of professionals also monitors our compliance with laws governing privacy rights, data protection and cybersecurity.

companyName: POOL CORP

ticker: POOL


text: Our designated IT team members monitor cybersecurity threats in real time for the Company at the enterprise level, with the assistance of third-party threat detection and monitoring software. Cybersecurity threats at the subsidiary level are also monitored in real time by experienced IT professionals at those subsidiaries, including our IT leadership at JM Bullion, AMS, Pinehurst, LPM, and SGI. These individuals report cybersecurity incidents immediately to our Chief Information Officer ("CIO") and Chief Privacy Officer ("CPO"), who in turn follow approved incident response and reporting protocols, as more fully described below.

companyName: Gold.com, Inc.

ticker: GOLD


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Information Technology" included as part of our risk factor disclosures in Item 1A of this Form 10-K.

companyName: Mechanics Bancorp

ticker: MCHB


text: Ferguson invests in associate training and education to prevent cyber attacks, including customized, role-based training provided to targeted internal audiences. In addition, we conduct periodic awareness campaigns and regular phishing email simulation tests to reinforce prior training and promote ongoing awareness of risks. We also periodically conduct tabletop exercises with management and other associates to practice cyber incident response and to improve our processes and strategies.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: The Senior Director of IT and Cybersecurity, in coordination with our executive officers, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, the Company's internal IT team is deployed to work with business functions across the Company to address cybersecurity threats and to respond to cybersecurity incidents. The Senior Director of IT and Cybersecurity, as leader of the internal IT team, monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the executive officers and Board when appropriate.

companyName: Axe Compute Inc.

ticker: AGPU


text: The Company maintains a comprehensive information security and cybersecurity program (the "Cybersecurity Program") guided by established best practice and tailored to the Company's business needs. The Cybersecurity Program is an extension of the Company's enterprise risk management program that seeks to identify and manage risks throughout the Company by having its Chief Financial Officer meet with members of each of the Company's various departments annually to solicit feedback regarding risks affecting the Company, which is then reported to the audit committee of our board of directors.

companyName: OUTFRONT Media Inc.

ticker: OUT


text: In the ordinary course of our business, we receive, process, use, store, and share digitally certain data, including user data as well as confidential, sensitive, proprietary, and personal information.

companyName: NightFood Holdings, Inc.

ticker: NGTF