text: In-sourced IT Services: By in-sourcing IT services in late 2023, we gained greater control over IT decisions, established a comprehensive knowledge base, and laid a framework allowing for unbiased assessments of future IT and cybersecurity investments.

companyName: SES AI Corp

ticker: SES


text: Associated with Remote Client Access and Funds Transfer Requests the Sponsor does not provide its clients with online account access nor does process funds transfer requests. If the firm's business changes to allow for remote client access and funds transfer requests, the Sponsor will update the cybersecurity program accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client's personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR

secItem: Item 1C


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, vulnerability management, disaster recovery and business continuity plan, Incident response policy, system monitoring, data encryption and access controls.

companyName: Repare Therapeutics Inc.


text: As discussed in more detail under "Cybersecurity Governance" below, our Board provides oversight of our risk management and strategy processes.

companyName: TAO Synergies Inc.

ticker: TAOX


text: The Audit Committee of the Board of Directors oversees the Company's business risk assessment framework and identifies principal business risks confronting the Company, including cybersecurity issues. The Audit Committee also reviews and discusses with management the Company's cybersecurity, data protection and information technology risks, controls and procedures and the Company's plans to mitigate those risks. The Audit Committee discusses cybersecurity risks and exposures periodically with management as well as internal and external auditors. The VP, Information Technology and our internal audit team provide the Audit Committee with quarterly or as needed updates on the performance of our program and information security matters and risk.

companyName: KAMAN Corp


text: We have a rigorous and comprehensive cybersecurity program managed by a dedicated team of subject matter experts and is led by our Information Security Manager ("ISM"), who has extensive cybersecurity experience. We have implemented telehealth industry standard processes, policies, and tools, including regularly scheduled vulnerability scanning and third-party penetration testing to reduce the risk of vulnerabilities in our system.

companyName: MediXall Group, Inc.

ticker: MDXL


text: We have adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel, networks and systems, third-party systems and end-user devices.

companyName: StepStone Group Inc.

ticker: STEP


text: Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity and availability of customer and bank sensitive information. Any loss of confidentiality, integrity or availability introduces operational, compliance, strategic, transactional, reputational, legal and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Magnolia Bancorp and Mutual Savings and Loan Association. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use technical, administrative and physical controls.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: As of December 31, 2024, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: We have certain processes and policies in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program, and are integrated into our overall risk management program.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: We maintain a cybersecurity program, which includes processes for the continuous monitoring of our information systems in order to assess, identify and manage cybersecurity threats. We use known industry strategies to manage these cyber threats, including, without limitation, identity and access management, security awareness training, network security, physical access controls, endpoint security, encryption, incident response planning and vulnerability management. The relevant information collected from the tools is, among other things, leveraged to identify potential weaknesses, monitor threats that seek to identify and exploit these weaknesses and refine and adjust our security controls as the cyber threat landscape changes. Our cybersecurity program includes policies governing how employees access, use and interact with our firm assets and data deemed to be in our custody. Our security team considers industry cybersecurity best practices and applicable statutory and regulatory obligations when creating policies, implementing controls and engineering technology integrations.

companyName: Moelis & Co

ticker: MC


text: We maintain a risk-based third-party risk management process to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.

companyName: PENTAIR plc

ticker: PNR


text: The CIO meets regularly with leaders of our various information technology management teams to review and discuss our cybersecurity and other information technology risks and opportunities. Our global incident response plan sets forth a detailed security incident management and reporting protocol, with escalation timelines and responsibilities.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: The board of directors has delegated oversight of our cybersecurity program to the Audit Committee. As provided in the Audit Committee charter, the Audit Committee is responsible for review and assessment of a) cyber-security procedures and policies, b) cyber-security related risk mitigation initiatives, c) significant existing or emerging cyber-security risks (if any), d) reviewing the impact, execution of event-related plans, and e) disclosure requirements for any significant cybersecurity incident.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Adial's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our management team and key staff participate in regular cybersecurity training created by industry recognized cybersecurity providers. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: ADIAL PHARMACEUTICALS, INC.

ticker: ADIL


text: The Company acknowledges that third parties and clients may also be sources of cybersecurity risk for the Company. As a result, the Company engages in regular and ongoing reviews and discussions with vendors and clients regarding cybersecurity risks and opportunities to improve the Company's cybersecurity posture. The Company maintains a vendor risk management program to identify and help manage any third party cybersecurity risks.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: The Audit Committee has primary oversight of management's efforts to mitigate cybersecurity and technology risk and respond to cyber incidents. The Audit Committee receives updates throughout the year from the CAO and CSISO on cybersecurity and grid security issues, including compliance with regulations, employee training and drills, at every regularly scheduled Audit Committee meeting, and engages in discussions throughout the year with management on the effectiveness of Duke Energy's overall cybersecurity program and progress for addressing any identified risks. In 2024, the Audit Committee received three updates and the full Board of Directors received one update on cybersecurity. The Audit Committee also receives periodic updates on Duke Energy's digital transformation and the operation of, and enhancements to, the Company's financial systems and business and operational technical systems. The reviews presented to the Audit Committee are followed with an update to the full Board of Directors by the Chair of the Audit Committee.

companyName: PROGRESS ENERGY INC


text: Our executive leadership team is responsible for the global risk management framework and influences the culture of risk management within the Company. Additionally, our Board is responsible for oversight of the executive leadership team's approach to risk management and cybersecurity strategy. The Board recognizes the importance of maintaining security and the trust of our customers, clients, business partners and associates. The Company has developed a cybersecurity program founded on a strong management approach, policy driven governance, standards and procedures, and execution of a comprehensive strategy that adapts to changing risks. The Company's cybersecurity policies and standards are fully integrated into our overall risk management process and were created based upon the National Institute of Standards and Technology cybersecurity framework and other applicable industry standards. The Company endeavors to manage cybersecurity risks through a comprehensive and multidisciplinary approach that emphasizes confidentiality, security, and availability of our information by deploying processes to support identification of cybersecurity threats and using tools for prevention and mitigation of cybersecurity incidents. To the extent that cybersecurity incidents may occur, the Company has established cross functional procedures that enable a prompt and effective response to cybersecurity incidents.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Director of Operations & Information Technology has approximately 20 years of experience in his field, and our Director of Operations & Information Technology holds certifications in cybersecurity from accredited information technology certification providers.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: Board Oversight of Cybersecurity Risks The audit committee of the Board of Trustees of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: KKR FS Income Trust


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: RetinalGenix Technologies Inc.

ticker: RTGN


text: Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.

companyName: Spectaire Holdings Inc.


text: Cybersecurity assessment The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: As one of the elements of the Company's overall risk management program, the Company's cybersecurity program is focused on the following key areas: • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to among other things: • Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures; • monitor Company networks, servers and endpoints to identify vulnerabilities; • perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness; • obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; • determine and execute mitigation and remediation options and plans; and • ensure ongoing compliance with applicable legal and regulatory requirements, including notification to required individuals and regulatory bodies in the event of the discovery of an information security breach as defined under applicable laws, and timely and adequate disclosure under applicable SEC rules. • Education and Awareness: The Company provides annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: 1.Comprehensive Risk Assessments: We conduct regular and comprehensive assessments to identify potential cybersecurity risks to our organization. These assessments encompass internal systems, networks, applications, and data repositories, as well as external threats and vulnerabilities within the broader digital ecosystem.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Apollo's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously Apollo's CISO for nearly eight years. Apollo's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.

companyName: Apollo Debt Solutions BDC


text: We face numerous cybersecurity risks that include cyber-based attacks and other security threats to our systems. We also could be adversely affected by cybersecurity incidents affecting our suppliers and other third-party service providers. To meet these threats, we expend considerable resources on cybersecurity risk management, strategy and governance.

companyName: Ingredion Inc

ticker: INGR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in our risk factor titled "Security incidents, loss of data, cyberattacks, and other information technology failures could disrupt our operations, damage our reputation, and adversely affect our business, operations, and financial results," in Part I, Item 1A. "Risk Factors." Refer to this risk factor for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: We experience cyber-attacks and other attempts to gain unauthorized access to our systems on a regular basis, and we anticipate continuing to be subject to such attempts. Despite our implementation of security measures, (i) our products and services, and (ii) the servers, data centers, and cloud-based solutions on which our and third-party data is stored, are vulnerable to cyber-attacks, data breaches, malware, and disruptions from unauthorized access, tampering or other theft or misuse, including by employees, malicious actors or inadvertent error. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Airspan Networks Holdings Inc.


text: Our Board of Directors has delegated authority to its Audit Committee to oversee risks associated with cybersecurity threats. Members of the Audit Committee receive updates periodically from our CISO regarding cybersecurity risks. These updates include, among other topics, reviews of existing and newly identified cybersecurity risks, status updates on how management is addressing and/or mitigating those risks, information about cybersecurity incidents (if any), as well as updates regarding the status of key cybersecurity initiatives.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: As part of our enterprise risk assessment function, which is led jointly by IZEA's President & COO; our Director, Systems & Security; and our Senior Development Operations (DevOps) leader, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as SOC-2 compliance for systems and organization controls related to our software development, and maps to standards published by Center for Internet Security (CIS) for our day to day operational stance. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Given the increasing reliance on technology and potential cyber threats, information security (and by entailment cybersecurity) is a critical component of this program. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the enterprise risk management organization, which is overseen by our Chief Risk Officer. As discussed below, our CISO reports periodically throughout the year on cybersecurity related risks, threats, and our responses, to the Technology Committee and our board of directors.

companyName: GUARANTY BANCSHARES INC /TX/


text: The Company's program to identify, assess, and manage cybersecurity risks is currently led by our Senior Vice President, IT Operations, and leverages the expertise of our Chief Financial Officer and General Counsel. Our Senior Vice President, IT Operations holds a Bachelor of Business Administration in Business Computer Information Systems and has over 20 years of work experience, with more than 5 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs. Our Senior Vice President, IT Operations, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company's cybersecurity and data privacy risk mitigation plans.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: We are cognizant of the evolving risks associated with cybersecurity and recognize a material cybersecurity incident could adversely impact our financial results and condition. We further recognize the importance of maintaining processes to identify, mitigate, and manage those cybersecurity threats. No cybersecurity threats occurred during the year ended December 31, 2024 that have had, or are reasonably likely to have had, a material impact on our business strategy, results of operations, or financial condition. However, if as a result of any future attacks, our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate our business, and our business strategy, results of operations or financial condition could be adversely affected. Such attacks, whether or not successful, could result in significant costs related to, for example, repairing or replacing our IT systems; the loss of critical data; and interruptions or delays in our ability to perform critical functions. In addition, the volume, frequency and sophistication of these threats (including through the use of artificial intelligence) continues to grow and the complexity and scale of the systems to be protected continues to increase.

companyName: FreightCar America, Inc.

ticker: RAIL


text: Governance and Risk Management The entire Board of Directors has oversight of risks from cybersecurity threats and receives periodic updates on such risks from the Company's management, including from the Company's President and CEO and its Vice President, Chief Information Security Officer (CISO).

companyName: BERKLEY W R CORP

ticker: WRB


text: The Company has experienced, and expects to continue experiencing, these types of threats and attempted intrusions. The implementation of additional security measures could increase costs and have a material adverse impact on the Company's financial results. Cyber insurance has been obtained to provide coverage for a portion of the losses and damages that may result from a security breach of information technology systems, but such insurance may not cover the total loss or damage caused by a breach. In addition, all costs of responding to and recovering from a cyber incident may not be covered by insurance. These types of events could also require significant management attention and resources, and could adversely affect the Company's reputation with customers and the public.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: We seek to automate processes and remove the potential for human error to the extent feasible by implementing technology solutions. From fundamental IT security to development of our software products and keeping our customers' data safe, we aim to maintain a secure infrastructure that is appropriately monitored for possible threats.

companyName: PTC INC.

ticker: PTC


text: Like all modern businesses within the global economy, we are susceptible to cybersecurity threats. Our suppliers, vendors, and customers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, financial position, business strategy, and results of operations. As discussed in more detail below, we have policies and procedures in place as part of our overall risk management strategy to, among other things, monitor our systems, train and raise awareness of cybersecurity threats amongst employees, and detect intrusions on our systems.

companyName: Installed Building Products, Inc.

ticker: IBP


text: The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board of Directors, through the Information Technology Steering Committee (ITSC) and Compliance Risk Management Committee (CRMC), provides direction and oversight of the risk management framework of the Company including cybersecurity risks. The ITSC and CRMC establish policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: Overseeing Third-party Risk We require that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. Our Governance, Risk and Compliance team conducts security assessments of critical third-party providers before engagement and maintains ongoing annual monitoring to mitigate risks relating to data breaches or other security incidents originating from third-parties.

companyName: WORKIVA INC

ticker: WK


text: The COO regularly informs the CEO and CFO on cybersecurity risks and initiatives. Significant cybersecurity matters will be escalated to the audit committee for review, where management will provide detailed updates on risk assessments, incident response, and the effectiveness of our cybersecurity strategies. The audit committee will continue to evaluate the progress of our cybersecurity initiatives and offer guidance to help strengthen our efforts.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: Oversight of Cybersecurity Risks by the Board of Directors and Management PPL's Board of Directors oversees the Registrants' management of cybersecurity risk through various processes identified below.

companyName: PPL ELECTRIC UTILITIES CORP


text: Company's cybersecurity program is overseen by our VPE&T, who is responsible for global information technology, including cybersecurity. Our VPE&T is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. The information security organization is comprised of internal IBO employees and external security suppliers who provide security monitoring and response.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: a. Security Team Expertise: Our security team, led by our Chief Information Security Officer (CISO), who oversees our cybersecurity risk assessments, the implementation of security controls, and the coordination of our incident response efforts.

companyName: KALTURA INC

ticker: KLTR


text: Cybersecurity risk management is an integral part of our technology modernization program. It is integrated into our business, as well as the broader software and digital environment. Our technology modernization program will move many of our core applications to industry-specific healthcare cloud solutions that offer robust HIPAA compliant, data security capabilities and tools. Our modernization plans revolve around simplifying our technology estate to reduce technical debt, automate security functions, and enable applications to take full advantage of best-practice, cloud security capabilities.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying processes and controls of our program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The program is subject to annual risk assessment by a third-party consultant to ensure compliance with the standards of the NIST CSF and to identify, quantify and categorize material cyber risks. In addition, with the assistance of the consultant, we have developed a risk mitigation plan to address cyber risks, and where necessary, remediate potential vulnerabilities.

companyName: Sachem Capital Corp.

ticker: SACH


text: Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we offer ongoing cybersecurity support to Affiliates through our information security program, including with respect to conducting Affiliate program assessments and assisting, as appropriate and practicable, in their identification of, and response to, an actual or suspected cybersecurity incident. Additionally, prior to any investment in a new Affiliate, we conduct a diligence review of its information security program.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to Company policies, and at least once per quarter the Company's CCO reports to the Audit Committee generally on cybersecurity matters and material risks, if any, from cybersecurity threats.

companyName: ALIMERA SCIENCES INC


text: The IT Service Provider provides Angel Oak Capital with regularly scheduled status reports, including summaries of vulnerabilities, any cybersecurity threats or incidents and the status of responses, and meets with Angel Oak Capital's Chief Operating Officer and Angel Oak Capital's Head of Information Technology (the "Head of IT") on a regular basis to review the reports and the IT Service Provider's services.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition.

companyName: EPR PROPERTIES

ticker: EPR


text: Our ACT reports to our CIO. Our CIO reports to our CTO who in turn, reports to our CEO who, in turn, reports to our Board of Directors. Our CIO has 30 years of experience in leading global security functions and strategies. Collectively, the other members of our ACT and SOT relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ACT and SOT.

companyName: QXO, Inc.

ticker: QXO


text: The proper confidentiality, integrity, and availability of the Company's information systems are critical to the business. Securing the Company's business information, customer, patient and employee data, and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements, and maintaining the trust of its stakeholders. As part of its enterprise risk management program, the Company has processes in place to assess, identify, and manage material business, operational and legal risks from cybersecurity threats. Such risks include business disruption, fraud, extortion, reputational harm, violations of laws and regulations, litigation, and harm to employees, patients, customers and business partners.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: We engage a consultant to maintain our website, email, financial record keeping and related internet capabilities, including, as necessary, addressing any cybersecurity incidents. To date we have not experienced any material cybersecurity incidents. Given the nature of our operations (single location, minimal customer interface, no gathering of customer digital data,ect.), we do not believe that we are reasonably likely to face any material cybersecurity risks.

companyName: Norris Industries, Inc.

ticker: NRIS


text: Each of the management and response teams, within its assigned level, is responsible for providing an orderly response to security incidents and risk events; preventing a serious loss of profits, public confidence, or information assets by providing an immediate, effective, and skillful response to any unexpected event which negatively impacts the confidentiality, integrity, and/or availability of our systems, network, or the non-public personal information of its customers, interruptions to customers' experiences, or other anomalous situations; taking the steps it deems necessary to contain, mitigate, or resolve a security incident or risk event; and investigating suspected security incidents and risk events in a timely and cost effective manner, reporting findings to management, determining an appropriate course of action, and coordinating communications to customers, regulatory authorities, and law enforcement agencies as necessary.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: We rely on the information technology and systems maintained by our manager, RMR, and rely on our manager to identify, assess and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's Chief Information Officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: OFFICE PROPERTIES INCOME TRUST

ticker: OPITQ


text: As of December 31, 2023, cybersecurity risks have not materially affected the Registrants' business strategy, results of operations, or financial condition.

companyName: DTE Electric Co


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management system through reporting of cyber risks to Technology and Information Security Oversight Committee, Operational Risk Committee, Enterprise Risk Committee, and Board Risk Oversight Committee. Risk Appetite statements are approved by the Board Risk Oversight Committee and the Board, and Key Risk Indicators are monitored on an ongoing basis by the Information Security team, and the Operational Risk and Enterprise Risk Committees. The Company performs regular Information Security focused Risk Assessments at the entity level, including but not limited to assessments based on the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (FFIEC CAT) and Ransomware Self-Assessment Tool (R-SAT), and National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: Independent Bank Group, Inc.


text: The Company has a designated IT Security Team to maintain its cybersecurity program and oversee third-party service providers that provide cybersecurity protection. The IT Security Team is tasked with the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and reports to our DevOPS/Security Manager. The team is comprised of personnel with a broad range of experience across the business and information technology industries, including our DevOPS/Security Manager, and employees in senior legal and administrative roles. The IT Security Team relies on the advice of the Manager DevOPS/Security related to the security of our data and any mitigation steps necessary.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Education and Awareness All employees are required to complete information security awareness training upon joining the Company. Based on individual phishing test performance and job requirements, additional training may be offered or required on an as-needed basis.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: In addition to our dedicated cybersecurity team, Wintrust's approach to cybersecurity is supported by dedicated risk management and internal audit teams. Our governance program maintains policies and standards, which are validated through risk-based assessments, reviews and testing. The CSO reports at regular intervals to the Wintrust Enterprise Risk Management Committee, the IT/IS Committee, and the Audit Committee of the Wintrust Board of Directors, as well as the full Wintrust Board of Directors, as necessary. The Audit Committee performs an annual review of our cybersecurity program, which includes a discussion of management's actions to identify and detect threats and incident plans in the event of a response or recovery situation. The Audit Committee receives an annual review that includes review of recent enhancements to the cybersecurity program and management's progress on its cybersecurity strategic roadmap. In addition, the full Board of Directors receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and an overview of recent threats and how the Company is managing those threats. For more information on the material risks that cybersecurity threats pose to us, please see our risk factor disclosures under Item 1A of this Annual Report on Form 10-K.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced. As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment. As a result of the Security Incident, we are currently subject to certain legal proceedings, claims and investigations and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. See Note 11 to the consolidated audited financial statements contained in this Annual Report on Form 10-K for additional information regarding the Security Incident and its past and potential impact on the Company.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team ("SMT"), and, as discussed below, periodically to our Board of Directors. As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy ("ICSPP") and Information & Cyber Security Response Policy ("ICSRP").

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: conduct regular security assessments, vulnerability scans, and penetration tests (including by third-party assessment firms) of products systems and internal systems to discover vulnerabilities and apply appropriate mitigations within standardized timelines;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology a security officer responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks and describing our ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer ("CISO"). Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.

companyName: Workday, Inc.

ticker: WDAY


text: Threats are discussed in ITEM 1 A. RISK FACTORS, under the heading RISKS RELATED TO PRIVACY, CYBERSECURITY AND TECHNOLOGY in this Annual Report on Form 10-K. We are not aware of any material cybersecurity incidents in the past that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.

companyName: WIDEPOINT CORP

ticker: WYY


text: We have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we continue to face risks from cybersecurity threats that, if realized, may have such material effect. Despite our ongoing efforts, we cannot provide complete assurance that our cybersecurity risk management processes will be effective in detecting, preventing, or mitigating such cybersecurity risks. See also "We have undertaken a multi-year initiative to upgrade our digital and information technology systems and capabilities. We significantly rely on our, and our third-party service providers', ability to successfully implement, upgrade and sustain information technology systems and to protect associated data and system availability" and "Any significant compromise or breach of our data security, including the security of customer, associate, third-party or Company information, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity risks that could have a material impact on the Company, which sections should be read in conjunction with this Item 1C.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Risk and Issues Disclosure As of November 30, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company, nor do we believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, we previously have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in our industry. We face risks of incidents, whether through cyber-attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware, and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Risks Related to Employees, Managing our Growth and Other Legal Matters—We depend on our information technology systems, and any failure of these systems, or those of our CROs, third-party vendors, collaborators or other contractors or consultants we may utilize, could harm our business. Security breaches, cyber-attacks, loss of data and other disruptions could compromise sensitive information related to our business or other personal information, prevent us from accessing critical information and expose us to liability, which could adversely affect our business, reputation, results of operations, financial condition and prospects."

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Board of Directors currently does not have a formal structure for cybersecurity oversight. The Company intends to review and establish appropriate oversight in the near future.

companyName: Genvor Inc

ticker: GNVR


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Executive Director of IT works with executive management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our Executive Director of IT and executive management also evaluate material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of our Board of Directors, or the Board.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Our management team, led by our Vice President of Information Technology ("VP of IT"), has operational responsibility for our cybersecurity and information security framework and risk management. Our VP of IT has extensive cybersecurity knowledge and skills gained from over 20 years of experience in leading and managing global IT operations and security teams. In addition, our VP of IT has a Master of Science degree in Management of Information Systems from Rensselaer Polytechnic Institute. Our VP of IT is supported by a team of enterprise information system and security risk professionals. The VP of IT receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Administrative Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our VP of IT supervises any retained external cybersecurity consultants.

companyName: Knowles Corp

ticker: KN


text: Our steering committee includes our CISO, our Chief Information Officer, our Senior Vice President and Chief Security Officer, our Senior Vice President, Internal Audit, our Chief Technology Officer, our Vice President, Corporate Legal, CoreSite's Senior Vice President of IT & Digitization and CoreSite's Vice President of Information Security and IT Infrastructure. Our CISO has held information security and IT leadership positions across large organizations for eight years, which included overseeing governance and compliance programs. Our Chief Information Officer has held IT leadership positions across large, multi-national companies for nearly three decades, where he has overseen cybersecurity programs. Our Chief Security Officer heads our converged physical and information security team and has over 26 years of experience in the corporate security, crisis management, and security consulting industries, including as head of global security for a major mining company and through leadership positions in several international risk consultancies. Our Senior Vice President, Internal Audit, has over 30 years of international finance leadership experience and heads our Internal Audit function, including the evaluation of risk and vulnerabilities for both physical and system assets and the testing of related controls. Our Chief Technology Officer has over 30 years of experience in the technology space, including leadership roles with wireless carriers and chip manufacturers, where cybersecurity was critical to the delivery of secure solutions. Our Vice President, Corporate Legal also serves as our lead Privacy Officer and is a lawyer who has led our privacy program since its inception. CoreSite's Senior Vice President of IT & Digitization has led CoreSite's IT function for over 5 years, including having responsibility for securing the business's cybersecurity environment. CoreSite's Vice President of Information Security and IT Infrastructure has over 25 years of experience building secure IT solutions across large network and data center environments and has been responsible for the day-to-day operation of CoreSite's business-critical IT environment since 2015.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Supplier Engagement – We review critical third-party systems at least annually, including the various System and Organizational Controls ("SOC") reports or perform risk assessments.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a cybersecurity program that endeavors to identify risks, protect assets, detect threats, respond to incidents, and recover from damaging events in a prompt and effective manner with the goal of minimizing business disruptions through effective governance of people, processes, and technologies. • External Collaboration: We collaborate with third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats, including compromises of our information systems and our data's confidentiality, integrity, and availability. These include firewalls, disaster recovery capabilities, malware and ransomware prevention, access controls, and encryption. • Education: We provide monthly training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Incident Response Planning: We have established and maintain incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which a material incident would be communicated to executive management, our BOD, external regulators and shareholders. • Governance: Our BOD's oversight of cybersecurity risk management is led by the Company's Audit Committee, which oversees our ERM program. Cybersecurity threats, risks and mitigation are reviewed by the Audit Committee on at least an annual basis and such reviews include internal and independent assessment of risks, controls and overall program effectiveness.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: We maintain a robust information security program that is designed to protect our information and the information of our customers. Our information security program is based on a recognized cybersecurity framework established by the National Institute of Standards and Technology ("NIST") and establishes controls to mitigate critical areas of cybersecurity risk. Our information security program has adopted all elements of the NIST cybersecurity framework, including the six functions of identify, protect, detect, respond, recover and govern, as well as each of the categories and control groups thereunder. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST framework as a guide to ensure our information security program is designed to manage cybersecurity risks relevant to our business. Among other things, the cybersecurity controls in our information security program address information access rights, incident monitoring and response processes, information technology system configuration, network security, security architecture planning, mobile device security and compliance with information security policy requirements and protocols. These cybersecurity controls are designed to oversee, identify and mitigate risks from all cybersecurity threats, including those arising from our use of third-party service providers. Our cybersecurity controls are evaluated regularly by our internal information security team, and we engage a third party examiner to assess the maturity of our information security program against the NIST cybersecurity framework no less frequently than bi-annually. Additionally, our information security program is assessed periodically by a federal regulator in the United States as part of its routine audit of the Company. In addition to our internal assessments, we also assess our third-party service providers on a regular basis using a risk-based approach that assigns a risk calculation to each such service provider. The results of our assessments are tracked and evaluated to ensure these third parties comply with our cybersecurity standards. We require all employees to undertake data protection and cybersecurity training and compliance programs annually.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Our Program is integrated into our Enterprise Risk Management (ERM) program and includes a vendor risk management program supported by our security and compliance teams. We assess vendor cybersecurity risks according to HIPAA and NIST CSF standards and have established an oversight process which we periodically review to manage cybersecurity risks related to the products and services we procure.

companyName: InnovAge Holding Corp.

ticker: INNV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Cyberattacks or other failures in our telecommunications or information technology systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations which could materially affect our results."

companyName: Atai Beckley N.V.

ticker: ATAI


text: Cybersecurity events are continuously monitored by global security operations centers staffed in the United States, European Union, and Asia Pacific regions with events and incidents being managed based upon the MITRE ATT&CK framework, a system for classifying and describing cyber attacks and intrusions. Management provides guidance and is informed of cybersecurity events through a committee with cross-functional representation of executive leadership. The committee meets at least quarterly for activities such as determining policy, reviewing active risks, assessing impact of emerging threats or regulatory changes, and monitoring active incidents. This committee also receives escalated alerts within 24-hours of confirmed cybersecurity events, and will determine the severity of the incident, engage with crisis management as necessary, and disseminate that information internally as appropriate and warranted.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: We have processes to assess, identify and manage risks from cybersecurity threats as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. We engage certain external advisors to enhance our cybersecurity oversight where necessary. Whereas a member of our board of directors, Mr. Wesley Fry, is a cybersecurity expert.

companyName: GPODS, INC.


text: We have a formal information security program, designed to develop and maintain privacy and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information. This program is governed by a committee comprising members of senior management, including our Chief Information Officer ("CIO"), which meets regularly and reports to the Board of Directors at least annually (the "Information Security Governance Committee").

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Our CTO attends regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, and reports on cybersecurity matters as appropriate.

companyName: NCR Voyix Corp

ticker: VYX


text: As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks. In the fourth quarter of fiscal year 2019, a ransomware incident encrypted information on our systems and disrupted customer and employee access to our systems and services, which resulted in the Company incurring costs relating to this event, including costs to retain third party consultants and forensic experts to assist with the restoration and remediation of systems and, with the assistance of law enforcement, to investigate the attack. As a result of this cybersecurity incident, we experienced increased expenditures for our IT infrastructure, systems and network. This ransomware incident also adversely affected our operations and the Company's fourth quarter 2019 revenue. See Note 18 to the consolidated financial statements in Part II, Item 8 of this Report for additional information.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO and Deputy CISO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our cybersecurity risk management program includes: • a security incident response plan that includes procedures for responding to cybersecurity incidents; • risk assessment processes designed to help identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • our Information Security team, principally responsible for identifying and mitigating cybersecurity risks, and managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test (including penetration test) or otherwise assist with certain aspects of our security controls and processes; • global security operations center services through certain service providers; • implementation of new hire and annual data privacy and cybersecurity training of employees, including senior management, and cybersecurity governance training for our Board of Directors; • a cybersecurity insurance policy to cover certain types of costs and losses from cybersecurity incidents; and • a third-party risk management process, including risk assessment and risk rating (using common vulnerability scoring system or similar methodologies based on industry practices), for certain service providers, suppliers and vendors.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Our information security function, our Chief Information Officer (CIO), and our Chief Compliance Officer (CCO) help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Cybersecurity Risk Management and Strategy Air Wisconsin's approach to mitigating information technology ("IT") and cybersecurity risk is comprised of a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of its critical IT Systems and information related to its business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, Air Wisconsin has aligned its cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Air Wisconsin assesses its cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that it meets any particular technical standards, specifications or requirements, only that it uses the NIST CSF as a guide to help it identify, assess and manage cybersecurity risks relevant to its business.

companyName: HARBOR DIVERSIFIED, INC.

ticker: HRBR


text: Etsy recognizes the importance of information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property risks; harm to employees or members of our buyer and seller communities; violation of privacy or security laws; litigation or other legal risks; and reputational risks.

companyName: ETSY INC

ticker: ETSY


text: Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties. For high-risk third-parties, we perform due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance. We also review evidence of cybersecurity certifications and the results of independent audits. For high-risk third-parties with access to sensitive data or systems, we conduct more in-depth assessments. Our contracts with high-risk third-parties contain provisions related to data protection, confidentiality, incident reporting and compliance with all applicable laws and regulations. Throughout our engagements with high-risk third-parties, we maintain a monitoring program with respect to their cybersecurity posture. Leveraging tools such as security questionnaires, security ratings and external threat intelligence, we regularly review and update third-party risk assessments based on changes in the third-party's services or practices and the risk landscape.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Our approach to cybersecurity is tailored to suit the specific environment in which we operate and is based on recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our approach includes a comprehensive strategy featuring a risk management team lead by our Head of IT and a regularly tested incident response plan. We also identify our cybersecurity threat risks by comparing our processes to industry standards, as well as by engaging third party experts to conduct risk assessments, tabletop exercises, threat modeling, and vulnerability testing.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our cybersecurity functions are led by our Chief Operating Officer ("COO"), who reports to our Chief Executive Officer. Our COO's relevant experience in cybersecurity includes previous experience, such as having previously served as Chief Executive Officer of a company that provides geospatial intelligence software and as Chief Technology Officer at a global cloud-based enterprise software company. Our Vice President - IT Security & Compliance ("VPITSC"), under the direction of the COO, is responsible for overseeing our cybersecurity management program and the protection and defense of our networks and systems. The VPITSC's relevant experience in cybersecurity includes over twelve years of extensive experience at the Company in cybersecurity, in various progressive roles. The VPITSC manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Our dedicated cybersecurity team is led by our GCISO. Our current GCISO joined the Company in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management. Prior to joining the team, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brands, and oversaw the security of a global payment network, a corporate network and digital assets.

companyName: Cigna Group

ticker: CI


text: External Resources; Associate Training and Awareness We have developed a comprehensive information security program that relies on support from third-party experts and an internal training and awareness program aligned with industry standards and best practices.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Coastal engages third party auditors and consultants in connection with the Information Security Program, including conducting external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third-party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: Related to Cybersecurity Risks Our Vice President, Head of Information Technology meets periodically with representatives from our external partners to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats. The individual who currently holds the title of Vice President, Head of Information Technology has approximately 20 years of experience in information security and cybersecurity risk management. Our Vice President, Head of Information Technology reports to the Chief Financial Officer.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.

companyName: LGAM Private Credit LLC


text: We and our customers and suppliers have an increasing reliance on our technology systems and infrastructure. We aim to safeguard the digital infrastructure of Expeditors, enabling the highest levels of customer service while managing and minimizing risk and maintaining global compliance. The cybersecurity and risk management program within Expeditors is defined through strategy, execution, management, and oversight, with continual assessments to verify the program's overall effectiveness.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: The Global IT Team is led by the Chief Information Officer, who has served in various roles in information technology and information security for over 30 years and has significant experience across information security, infrastructure, operations and compliance. Our Chief Information Security Officer reports to the Company's Chief Information Officer and has served in various roles in information technology and information security for over 30 years. He leads a team that focuses on the Company's cybersecurity, including primary responsibility for leading enterprise-wide information security strategy, processes, as well as assessing, identifying, and managing cybersecurity risks, which is an integrated aspect of our overall enterprise risk management program.

companyName: BERRY GLOBAL GROUP, INC.


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding any risks from cybersecurity threats, including as a result of any cybersecurity incidents that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, refer to Part I, Item 1A, "Risk Factors," within this Annual Report on Form 10-K.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: Furthermore, we offer cybersecurity consulting as a service to clients. Our client-facing cybersecurity and information security experts periodically advise our cybersecurity and information technology teams regarding best practices. In addition, from time-to-time, they address our executives, directors, and other segment or regional leaders regarding complex issues faced by other companies that arise from data-security-related challenges. Among other things, they discuss new and evolving types and levels of threats and attacks, hacking and ransomware, foreign actors, risks driven by new and evolving technologies, including artificial intelligence, potential damages, and liability, and technological and other solutions potentially available to mitigate such risks, as well as other company responses. The existence of this team within FTI aids in our ability to have current incident and threat intelligence that we can use to bolster our own security posture and defenses. Our cybersecurity practice also provides us with supplemental incident response investigation services in partnership with independent, external consultants, as needed and as appropriate.

companyName: FTI CONSULTING, INC

ticker: FCN


text: f.run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies;

companyName: TruBridge, Inc.

ticker: TBRG


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: JUNIPER NETWORKS INC


text: We also require all employees to participate in cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: The Company treats cybersecurity risk seriously and is focused on maintaining and regularly updating the security of our systems, networks, technologies and data.

companyName: CHEMED CORP

ticker: CHE


text: Our Management Leadership Team reviews cybersecurity risks as part of their oversight and execution of the Company's business operations and strategy. The Company's Management Board, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. We have established oversight mechanisms intended to provide effective cybersecurity governance, risk management, and timely incident response.

companyName: Domtar CORP


text: 2023, Rubicon did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our strategies, operations, or financial condition. Rubicon cannot eliminate all risks from cybersecurity threats or other related risks or provide guarantees or assurances that we have not experienced undetected cybersecurity incidents. To that end, however, we believe cybersecurity is the responsibility of all related parties to our business.

companyName: Rubicon Technologies, Inc.


text: Enterprise Cybersecurity Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology ("NIST") standards, among others, and includes processes and controls for the deployment of new IT systems by us and controls over new and existing systems operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Our incident response program consists of an Incident Response Plan document and a cross-functional Incident Response Team, which are defined in our Information Security Policies. All workforce members are trained on incident reporting procedures, and there is a single point of contact for reporting all incidents. Incident response training is conducted annually, followed by a tabletop exercise. Our Incident Response Plan instructs personnel on how to notify our Incident Response Team in case of an incident. The VP of Information Security is the point person for incident responses and coordinates mitigation and remediation of cybersecurity incidents. We log all incidents and response plans for purposes of internal documentation. We report critical incidents to the management team, the Audit Committee, and the Board of Directors.

companyName: OptimizeRx Corp

ticker: OPRX


text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.

companyName: Owlet, Inc.

ticker: OWLT


text: In addition, the Company's VP of Information Technology works closely with an external Chief Information Security Officer to provide valuable perspectives and industry insights into evaluating cybersecurity threats. The Chief Information Security Officer has over twenty-five years of experience in cross-vertical security, software, and systems engineering.

companyName: Revance Therapeutics, Inc.


text: We adhere to a risk management framework based on applicable laws and regulations to handle cybersecurity risks across our products, services, infrastructure and corporate assets. We regularly conduct risk assessments to gauge the effectiveness of our systems, identifying areas for improvement. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions. Our cybersecurity risks and related responses are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by our Board of Directors. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.

companyName: Next Technology Holding Inc.

ticker: NXTT


text: Vertical data inc. does not have a formalized cybersecurity risk management process. However, the organization is working toward implementing a framework for assessing, identifying, and managing material risks from cybersecurity threats. A managed IT service provider continuously works to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. This includes assessing cybersecurity risk as part of an overall risk assessment and considering the likelihood and potential consequences of each risk. Plans also include the identification of critical cybersecurity risks (e.g., malware, phishing, ransomware, and unauthorized access) and the implementation of formalized mitigants to address those risks such as cybersecurity policies and incident response strategy.

companyName: Vertical Data Inc.

ticker: VDTA


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and our President and Chief Executive Officer, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Y-mAbs Therapeutics, Inc.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related data ("Information Systems and Data").

companyName: MANNKIND CORP

ticker: MNKD


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy, plan, procedures and scenario-based playbooks, an incident detection and response program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training and cybersecurity insurance. The Company has obtained Trusted Information Security Assessment Exchange (TISAX) certification labels within the United States and Germany.

companyName: GENTEX CORP

ticker: GNTX


text: Our entire Board receives regular reports from management on our cybersecurity risks. In addition, management updates our entire Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: Board of Director's oversight of cybersecurity risks The Board of Directors has oversight responsibility with respect to risk management and reviews matters with management as part of management's regular Board reporting. The Board of Directors has delegated responsibility for information security and cybersecurity risk oversight to the Audit Committee. In accordance with its charter, the Audit Committee discharges these responsibilities through various processes, including the option to use third party advisers as and when it deems appropriate, and discusses with management the Company's major policies with respect to risk assessment and risk management. The Audit Committee regularly reports the results of these discussions to the Board of Directors. As noted above, the CISO reports to the Audit Committee at each regular Audit Committee meeting on the status of cybersecurity risk assessment, identification and management, as well as reporting information security incidents as they occur, if material, and providing periodic briefings about our information security program, our internal response preparedness, and assessments led by outside advisors. The Chair of the Audit Committee, in turn, reports on these topics to the Board of Directors as and when deemed necessary and/or material. Overall, our Board contains two directors with work experience related to cybersecurity issues or oversight.

companyName: TELOS CORP

ticker: TLS


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: Genworth's risk management framework recognizes the significant operational risk, including risk of losses, from cyber incidents and the importance of a strong cybersecurity program for effective risk management. As part of our risk management, we have implemented a Data Security and Cybersecurity Program (the "DSCP") which sets policy expectations, ensures broad coverage over information technology risks, integrates the Information Security and Information Technology Risk Management Framework into our broader risk management systems, establishes clear roles and governance, and aligns control expectations to the National Institute of Standards and Technology ("NIST"). Under the DSCP, we have processes for identifying, assessing and managing technology and cybersecurity risk. The DSCP employs various controls and policies to secure our operations and information, which include monitoring, reporting, managing and remediating cybersecurity threats. Key features of the DSCP include access controls, security training, system security testing, dedicated security personnel, security event monitoring, and when necessary, consultation with third-party data security experts. Through a cross-functional team, we assess and mitigate risks associated with our third-party providers and have processes in place to regularly monitor and evaluate cybersecurity risks and threats associated with the use of third-party providers. Our information security team, overseen by our Chief Information Security Officer ("CISO"), conducts annual information security awareness training for employees involved in our systems and processes that handle customer data. We have conducted cybersecurity awareness training with management, including a tabletop exercise to simulate a response to a cybersecurity incident, and used these findings to improve our processes and technologies. In addition, the DSCP includes an incident response plan, which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to assess the materiality of the incident, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal reporting and other obligations and mitigate reputational damage. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: The Information Security Policy contains numerous distinct administrative and technical controls that govern data security for the organization and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The policy is reviewed and approved by the Board of Directors annually.

companyName: Investar Holding Corp

ticker: ISTR


text: Embecta has established a Cyber Security Incident Response Team, a cross-functional team composed of representatives from our Information Technology, Information Security, Research and Development, Privacy, Legal, and Human Resources groups. This team is responsible for the response to security threats by implementing our detailed incident response plan. Our incident response plan includes processes, procedures, and playbooks for assessing potential internal and external threats, developing remediation plans, and facilitating post-incident recovery; all designed to safeguard the confidentiality, integrity and availability of both Company and customer data.

companyName: Embecta Corp.

ticker: EMBC


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. In addition, while we have implemented a risk management process to mitigate cybersecurity risks that arise from utilizing third party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. For more information on our cybersecurity related risks, see Part I, Item 1A. Risk Factors of this Report.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: During 2024, we refreshed our business continuity program to assess the resilience of our processes and systems against potential threats, including cyber-attacks. Our refreshed crisis management and business continuity program establishes crisis management instructions with a detailed plan for each business department outlining critical processes, internal and external dependencies and recovery strategies. In addition, routine information security training and updates are regularly rolled out to our employees, and we track certain metrics that we believe help ensure we have a strong security posture.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: Our information technology ("IT") department regularly assess risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including but not limited to tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: The Company has developed policies and procedures with regard to cyber incident responses which policies and procedures are based on key components of the National Institute of Standards and Technology Cybersecurity Framework, together with other best practices. Since completion of the Separation and Distribution, the Company has not had any risks of cybersecurity threats or cybersecurity incidents that have materially affected or, to the Company's knowledge, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, if such a material cybersecurity incident is identified or were to occur, Company management would report it to the board of directors immediately.

companyName: Orion Properties Inc.

ticker: ONL