text: We employ processes for assessing, identifying, and managing material risks from cybersecurity threats that are incorporated into our overall risk management system. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our system includes procedural and technical safeguards, response planning, and reviews of our policies. We engage various external entities, including consultants, to improve and enhance our cybersecurity processes and oversight. We provide employees and consultants with cybersecurity and prevention training including timely and relevant topics covering phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: Cybersecurity Incidents Although we have been subject to breaches of our IT systems, including breaches of the IT systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through the date of this report. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.

companyName: Astrana Health, Inc.

ticker: ASTH

secItem: Item 1C


text: Depending on the environment, we implement and maintain various processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, implementation of security standards and certifications, encryption of data in transit and at rest, network security controls, data segregation, access controls, systems monitoring, vendor risk management program, employee training and penetration testing.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Related to Cybersecurity Risks The IT Director oversees and manages the day-to-day functions of our cybersecurity risk management program. The IT Director reports to the VP of Information Technology and Facilities, or VP of IT. The IT Director and VP of IT roles are both held by individuals who each have over twenty years of professional information technology, or IT, management experience. The VP of IT meets regularly with the Audit Committee to report on and discuss information security and technology risks to our business, including our cyber risk management programs, controls and procedures. The VP of IT and the Audit Committee also conduct a high-level review of the threat landscape facing our business, discuss risk mitigation strategies and the prioritization of our remediation efforts.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Board of Directors The board of directors oversees our processes for assessing and managing risk. Our audit committee is responsible for reviewing and discussing our practices with respect to risk assessment and risk management, including risks related to information technology and cybersecurity. The board of directors and audit committee periodically review the measures implemented by us to identify and mitigate risks from cybersecurity threats. As part of such reviews, the board of directors and audit committee receive reports and presentations from those responsible for overseeing our cybersecurity risk management, including the Partner, Chief Information Security Officer & Head of Information Technology ("CISO") and our Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers, industry participants, service providers and other third parties. The CISO also periodically presents to the board of directors and audit committee, including to describe our information security infrastructure and improvements made, and to report on any significant developments. From time to time, external legal advisers provide education to the board of directors and/or audit committee in respect of information security related developments and to provide training in respect of directors' responsibilities. We have a framework under which certain cybersecurity incidents are escalated and, where appropriate, reported to the board of directors or audit committee in a timely manner.

companyName: StepStone Group Inc.

ticker: STEP


text: While we face a number of cybersecurity risks in connection with our business and from time to time we have had to address non-material security incidents and expect to experience security incidents in the future, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face that may materially affect the Company, see the risk factor entitled "Risks generally associated with information systems, software products and cybersecurity attacks could adversely affect our results of operations" in Item 1A - Risk Factors.

companyName: PATTERSON COMPANIES, INC.


text: The Audit Committee of the Board of Directors receives an update from the members of management referenced above on our security posture on at least an annual basis, and more often as needed. The Audit Committee provides oversight as to the status of our cybersecurity apparatus and overall Program management (including with respect to the identification and implementation of planned security enhancements), while also advising on risk mitigation activities to address the latest threats.

companyName: TELEFLEX INC

ticker: TFX


text: Lastly, we use third-party intelligence resources to help identify cybersecurity threats via finished intelligence, alerts and consulting services that help answer requests for information. We have collaborative relationships with The Information Technology - Information Sharing and Analysis Center and several governmental agencies for identification of threats that target technology.

companyName: ANSYS INC


text: In addition, we maintain specific policies and practices governing our third -party security risks, including our third -party risk assessment (" TPRA ") process. Under our TPRA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to maintain security controls to protect our confidential information and data, and to notify us of material data breaches that may impact our data.

companyName: AvePoint, Inc.

ticker: AVPT


text: Our Information Security Policy is designed to align with certain best practices, including GDPR. This policy promotes the management and execution of our information security framework for preserving the confidentiality, integrity, availability and privacy of our information assets, including by helping enable us to better oversee, monitor and identify certain risks related to the processing of information by authorized third-party service providers. We also have an Information Technology ("IT") Steering Committee to help ensure security and compliance across our IT services. We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. We implement a layered strategy for overseeing and identifying material risks from cybersecurity threats associated with our use of third party service providers, including: (i) the use of a suite of Microsoft tools (including Microsoft Defender); (ii) a cloud IT strategy that eliminates any central platform; (iii) engaging a cybersecurity firm that monitors our systems 24/7 and provides daily alerts and updates; (iv) regular cybersecurity training for all employees and contractors; and (v) policies and procedures that govern employee activities along with technical controls in place to enforce those policies and procedures.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: Role of the Board Our Board of Directors plays an active role in overseeing our cybersecurity risk management program. The Board of Directors or the Audit, Compliance, and Risk Committee receives a quarterly update on cybersecurity-related topics. The Board of Directors receives materials every quarter and presentations on alternating quarters from our Chief Technology Officer (CTO) on topics including significant cyberattacks and emerging threats, cybersecurity program performance, results of risk assessments, incident response updates, cybersecurity strategy, and cybersecurity program maturity. We have also established procedures for promptly informing the Board of Directors of any material cybersecurity incidents outside of these scheduled briefings.

companyName: Waystar Holding Corp.

ticker: WAY


text: Our enterprise security team works closely with our senior management, information technology, legal and compliance teams to develop, implement, assess and improve our information technology security program, compliance and controls, as described in more detail above under "—Cybersecurity Risk Management and Strategy." By engaging in the development, implementation, assessment and improvement of our information technology security program, compliance and controls, the enterprise security team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. As described in more detail above under "—Board of Directors Oversight," our CISO reports to the Board of Directors regarding cybersecurity risks and cybersecurity incidents and also works with the Audit Committee to evaluate the program, compliance and controls in place to address cybersecurity risks and cybersecurity incidents.

companyName: Finance of America Companies Inc.

ticker: FOA


text: NNN's information systems process and store critical and sensitive NNN data. Management and the Board of Directors are committed to protecting NNN systems and data through layered perimeter, interrogation and access controls, as well as following a constant process of researching, assessing, patching and remediating. Processes to assess, identify, isolate, remediate and manage cybersecurity risks have been integrated into NNN's overall risk management system. Below are examples of actions NNN takes to protect NNN's information systems and data from cybersecurity risk: • Align systems and processes with best practices for securing NNN information systems and data; • Perform continuous systems monitoring and tactical measures for impending viruses, malware, tampering, exploits and other cyber threats; • Deploy systems tools to detect, prevent and neutralize cyber threats; • Engage independent third-party consultants to assist in evaluating cybersecurity risks and response profile and plans; • Identify, oversee and evaluate the risks associated with third-party service providers and consultants; • Continuously educate and provide procedural training to all associates and the Board of Directors regarding cybersecurity awareness and risks such as enterprise security, malware, data protection best practices, anti-phishing exercises and updates with respect to other implemented information security measures; • Periodically measure the effectiveness of associate training; • Cybersecurity risk management is periodically reviewed with the Enterprise Risk Management Team; • Perform ongoing internal and external penetration testing and vulnerability assessments with a high priority for timely remediation; and • Establish reporting deadlines and hierarchies so that data regarding an incident or possible incident is communicated in a timely manner to NNN's management, to the Audit Committee of the Board of Directors, and if, appropriate or required by law, to the Commission.

companyName: NNN REIT, INC.

ticker: NNN


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments;

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: We regularly assess cybersecurity risks associated with our use of suppliers and other third-party service providers. In this process, we classify by level of risk our principal suppliers and other key service providers and evaluate their data security controls and changes in potential cybersecurity risk levels. In addition, our contracts with these service providers require them to promptly report security incidents to us and to provide us with access to relevant information and resources to allow us to conduct related investigations.

companyName: Ingredion Inc

ticker: INGR


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls. Ongoing enhancements are integrated into our security roadmap, as informed by our security audits and assessments.

companyName: PENTAIR plc

ticker: PNR


text: •"—If we do not effectively implement our plans to migrate our technology infrastructure to the cloud, we could experience significant disruptions in our operations, which could have a material adverse effect on our results of operations and financial condition,"

companyName: ADT Inc.

ticker: ADT


text: We engage security consultants and other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards and to conduct regular vulnerability assessments for our internal assets. We require each third-party service provider to give assurance that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We review third-party service providers' policies, data protection procedures, intellectual property protection measures and incident response measures. Our CISO oversees our relationships with these third-party service providers.

companyName: Cricut, Inc.

ticker: CRCT


text: Board Oversight of Cybersecurity Matters The board of directors of the Partnership's general partner (the "Board") considers oversight of CVR Partners' risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Partnership's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Partnership's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Our board of directors has approved and delegated initial cybersecurity threat responses to the Incident Response Team. The Information Security Officer and Chief Information Officer are assigned as the Incident Response Team leaders and reports summaries of key issues, including significant cybersecurity and/or privacy incidents to Incident Response Team which includes the Chief Executive Officer. If appropriate, the Chief Executive Officer will communicate the actions taken to our board of directors. Further, given the ultimate oversight of the Company's information security programs, the Chief Legal Counsel will communicate any regulatory compliance matters related to information system, including cybersecurity, to the board of directors.

companyName: CITY HOLDING CO

ticker: CHCO


text: Cybersecurity risk is the risk of exposure to harm or loss resulting from misuse or abuse of technology by malicious actors. Cybersecurity risk is an important and continuously evolving focus for us as significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology assets. Security efforts are designed to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have experienced, and expect that we will continue to experience, a higher volume and complexity of cyber-attacks. We have implemented precautionary measures and controls reasonably designed that follow the National Institute of Standards and Technology (NIST) and other industry standards to address this increased risk.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our board of directors.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Management's Responsibilities. Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. Accordingly, management assesses and responds to cybersecurity threats as part of our ongoing risk assessment and as an internal control over financial reporting. Our Security Ops Team directs our cybersecurity operations and risk responses. Members of the Security Ops Team then meet with the InfoSec Committee at least once every quarter to review and assess cybersecurity incidents and non-incident threats (and response measures undertaken) to determine if any adjustment to our cybersecurity risk assessment is required. At least once every year, members of the Security Ops Team and the Senior Vice President of Information Technology present our cybersecurity risk evaluation and threat response to the Ethics Committee and to the Risk Committee of the Board of Directors as needed. The InfoSec Committee is a subcommittee comprised of IT department leaders and members of the senior management team, including the Chief Executive Officer, Chief Financial Officer (who has oversight of our IT and cybersecurity activities), General Counsel (who has oversight of our compliance activities), and Senior Vice President of Information Technology (who has over 20 years of experience managing IT systems and personnel). The Security Ops Team reports to the Senior Vice President of Information Technology, as well as the broader InfoSec Committee. Members of the Security Ops team include IT professionals with extensive experience and education in technology and cybersecurity, and most have attained accreditation as Certified Information Systems Security Professionals, as granted by the International Information System Security Certification Consortium (also known as ISC2).

companyName: EXELIXIS, INC.

ticker: EXEL


text: Containment, Eradication, Recovery, and Reporting Our IRP sets forth the procedures we follow in responding to a cybersecurity incidents. Once a cybersecurity incident is contained, our focus shifts to remediation and recovery. These activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions and validation of files or data that may have been affected. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: Public Storage

ticker: PSA


text: An incident response plan aligned with best practices guidelines governs our response to cybersecurity incidents. The incident response plan outlines how we can detect, analyze, contain, eradicate, recover, and perform post-incident activities in the event of a cybersecurity incident. It also contains an internal, risk-based escalation framework designed to ensure that all relevant individuals are promptly informed of any cybersecurity incident and dictates procedures for determining whether a cybersecurity incident is material without unreasonable delay.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: Incident Response Plan The Company has implemented an Incident Response Plan (IRP) to provide structure and a systematic incident response process for information security incidents that may affect any of the information technology systems, network or data. The Company's business continuity program provides a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the IT Steering Committee and the Board of Directors. Cybersecurity metrics are reported to the Audit Committee quarterly.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: [have developed and implemented/will develop and implement] a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program [will be/is] integrated into our overall enterprise risk management program and includes a cybersecurity incident response plan.

companyName: Hour Loop, Inc

ticker: HOUR


text: A team comprised of IT personnel responsible for directing (1) our cybersecurity risk assessment processes; (2) our security controls; and (3) our response to cybersecurity incidents;

companyName: CYANOTECH CORP

ticker: CYAN


text: The Company engages third-party consultants to conduct periodic penetration testing designed to identify potential security vulnerabilities. The Company's internal audit function, which has been outsourced to an international accounting firm, conducts periodic audits of cybersecurity and reports on such matters to the Audit Committee of the Board.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Our cybersecurity risk management is primarily the responsibility of our VP of Information Technology and information technology teams. Our VP of Information Technology has over 25 years of industry experience in the field of information systems and oversees our risk assessment programs, remediation of known risks, processes for the regular monitoring of our information systems and our employee cybersecurity training programs. Our Board of Directors also oversees cybersecurity risk through our Audit Committee who reviews periodic reporting and updates regarding our risk management associated with cybersecurity.

companyName: Permian Resources Corp

ticker: PR


text: Cybersecurity Governance Timberland Bank's Board of Directors ("Board") recognizes the significance of cybersecurity risks and provides oversight of the Bank's Cyber and Information Security Program. The Bank's Board of Directors is currently comprised of the Chief Executive Officer and seven non-employee directors; one of which has completed and received Cybersecurity Oversight Certification from the National Association of Corporate Directors ("NACD"). The Board receives cybersecurity updates at least quarterly, including risk metrics, incident reports, and progress on mitigation strategies.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Oversight of Third-party Risk We have processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third-party service providers provide us information about their security policies and procedures.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence. As such, the Board engages with our management team for periodic updates on our cybersecurity risk program and progress on remediation efforts.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: The board of directors is informed about cybersecurity risks on a periodic basis, especially when significant threats or issues are identified.

companyName: Zentrum Holdings, Inc.


text: We also maintain a third-party risk management process to mitigate vulnerabilities associated with external service providers and vendors. This includes reviewing service-level agreements and third-party security certifications, such as PCI DSS and SOC reports, on an annual basis or as-needed to ensure vendors adhere to our security and compliance standards.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: The Company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect the Company, its customers and themselves from cyberattacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • dedicated personnel principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the conduct of regular exercises and tests of our own systems to help discover potential vulnerabilities; • the use of external service providers, where appropriate, overseen by our IT team, to assist with assessing our systems; monitoring cybersecurity threats, including the proactive identification of vulnerabilities in our systems with threat intelligence, and our defenses against cyberattacks;and providing timely cybersecurity threat alerts; • new-hire, annual and ad hoc cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan, or the Response Plan, that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process, overseen by our IT team, for key service providers, vendors and collaborators, including a due diligence process that involves the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.

companyName: Mersana Therapeutics, Inc.


text: The Company's Board of Directors recognizes the importance of cybersecurity and has ultimate oversight of the Company's cybersecurity risk management program. As reflected in the Audit Committee's charter, the Audit Committee of the Company's Board of Directors has been delegated certain cybersecurity oversight responsibility and, among other things, monitors the Company's cybersecurity risk profile, receives periodic updates from management on all matters related to cybersecurity and reports to the full Board of Directors. The CISO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats.

companyName: Vestis Corp

ticker: VSTS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Security, who has managed the Security Operations Center for a Fortune 500 company, and led cybersecurity efforts as the Director of IT at another organization.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: We rely on information systems, computer networks and digital technologies to operate our business, including managing our operations, protecting sensitive data, communicating internally and externally, and preparing financial and operational information. Our cybersecurity program is designed to protect these critical systems and data while supporting business operations and growth objectives.

companyName: California Resources Corp

ticker: CRC


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full Board has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In the event a cybersecurity incident occurs, the Company's Chief Executive Officer and the Chief Financial Officer are expected to inform the Board of the details of such incident as well as the measures taken in response to such incident. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: WILLAMETTE VALLEY VINEYARDS INC

ticker: WVVI


text: We rely on information systems to obtain, process, analyze, and manage data, as well as to facilitate the manufacture and distribution of inventory to and from our facilities. We receive, process, and ship orders, manage the billing of and collections from our customers, and manage the accounting for and payment to our vendors. We also manage our production processes with certain industrial control systems. Consequently, we are subject to cybersecurity risk.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our board of directors, our audit committee regularly interacts with, and receives reports from, our management, the Manager, Apollo, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: The audit committee of our board of directors is responsible for the general oversight around cybersecurity-related matters, while our management is responsible for the day-to-day operations around the assessment and management of any cybersecurity risks we might face. Our board of directors and the audit committee, in consultation with management, established and maintained robust procedures and internal controls around cybersecurity. These mechanisms are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: We have a security incident response plan in place. We use this incident response plan as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The incident response plan is a set of coordinated procedures and tasks that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.

companyName: Summit Materials, LLC


text: The KESC, our cybersecurity leaders, and/or our CIRT evaluate each incident, as appropriate, in terms of its impact on our operations, our ability to conduct business with customers and suppliers, our brand reputation and health, safety, and the speed and degree to which the incident has been contained. These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident. After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CL&AO and CIRT about the same.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Primerica's senior executive leadership is actively involved in managing material risks from cybersecurity threats. Primerica's cybersecurity operations risk steering group is chaired by the Chief Insurance Officer and holds quarterly meetings. It includes key executives from the Company's technology, security, privacy, and legal teams, coordinates corporate security initiatives and provides high-level guidance on technology-and security-related issues. The Chief Information Security Officer has responsibility for assessing and managing the Company's material risks from cybersecurity threats. The Chief Information Security Officer has served in various roles in information technology and information security for 36 years, including serving as the Company's Chief Information Security Officer for over 24 years.

companyName: Primerica, Inc.

ticker: PRI


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our Risk Management Committee is responsible for assessing and categorizing any significant identifiable risks and presenting them to senior management in a timely manner along with recommendations on how to manage these identified risks. All potential risks are identified, quantified, and categorized in such a manner that they can be ranked and presented to senior management for appropriate disposition (such as avoidance, acceptance, mitigation, etc.). Our CTO and Director of InfoSec have the primary responsibility for managing our cybersecurity program and efforts. They are advised by our General Counsel, who has extensive government experience with cybersecurity issues and regulations. We perform internal audits of our internal information technology controls and implementation, and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity incidents in an effective and efficient manner.

companyName: Rumble Inc.

ticker: RUM


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of information technology risk management, legal and compliance personnel of the Advisor, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Overland Advantage


text: At Katapult, cybersecurity risk management is an integral part of our overall enterprise risk management program and information security protocols. Our cybersecurity risk management program is based on industry best practices and CIS Critical Security Controls for handling cybersecurity threats and incidents, including threats and incidents associated with the use of internally developed applications and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees throughout the year.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall Enterprise Risk Management (ERM) process. As part of the ERM, the Company focuses on developing multi-layered, collaborative processes to identify, monitor, and manage risks from cybersecurity threats. Risks are grouped into categories that management can then assess, monitor, and prioritize based on the likelihood of an occurrence, level of impact, and mitigating factors.

companyName: Alcoa Corp

ticker: AA


text: with external service providers to evaluate, enhance, or support our security measures; and incident response plan outlining specific procedures for managing cybersecurity incidents;

companyName: Idaho Copper Corp

ticker: COPR


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: We undertake regular NIST CSF and CIS 18 Critical Security Controls assessments, conducted by a third-party, to measure program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review with various frequencies and on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: The Company uses third-party security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. Third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations and performance monitoring.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Chief Financial Officer, who has more than 15 years of experience, including cross-functional expertise in business operations and technology strategy. Under the guidance of our Chief Financial Officer, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.

companyName: Genprex, Inc.

ticker: GNPX


text: While we have invested, and continue to invest, in the protection of our data and IT infrastructure, we regularly face attempts by others to access our information systems in an unauthorized manner, to introduce malicious software to such systems or both, and while we have not been materially impacted by computer viruses, malware, ransomware, hacking incidents, outages, or unauthorized access to data, we have been (and may in the future be) the target of such events. However, to date, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see Item 1A, Risk Factors — "Our operations and our customer relationships may be adversely and materially affected by disruptions to our IT systems, including disruptions from cybersecurity breaches of our IT infrastructure" in this Annual Report.

companyName: CELESTICA INC

ticker: CLS


text: We are currently working with outside counsel to further develop a formal cybersecurity incident response plan as a part of our review of and improvements to the Company's cybersecurity policies.

companyName: CorMedix Inc.

ticker: CRMD


text: The GM Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CCO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to GM's Executive Vice President, Legal, Policy, Cybersecurity, and Corporate Secretary as well as to the Risk and Cybersecurity Committee. The CCO has served in this role for four years, and has more than 11 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CCO holds a bachelor's degree in electrical engineering and a master's degree in systems engineering, with over 10 years of previous software and hardware systems engineering experience. The CCO chairs the Automotive – Information Sharing and Analysis Center (ISAC) and serves on the Department of Homeland Security – Cybersecurity and Infrastructure Security Agency (DHS-CISA) Advisory Committee.

companyName: General Motors Co

ticker: GM


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of IT, who holds a Bachelor of Science in Computer Methods from California State University-Long Beach and has previously served as a Director and Associate Director of IT for large pharmaceutical companies.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: The Company faces motivated and persistent cybersecurity threats from a variety of adversaries on a daily basis. As a manufacturing company dispersed across multiple states supported by a global supply chain, the Company recognizes the critical importance of maintaining the safety and security of its networks and systems, as well as ensuring the confidentiality, integrity, and availability of its data. The Company employs a holistic process for overseeing and managing cybersecurity and information security risks which is supported by both management and its Board of Directors. As described in more detail below, the Company has established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. The Company has devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations and intends to continue to make significant investments to maintain the security of its data and cybersecurity infrastructure.

companyName: BOSTON BEER CO INC

ticker: SAM


text: Our cybersecurity risk management program includes: • Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise information technology ("IT") environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • Performing a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; and • Ensuring risk is addressed and tracking any necessary remediation through an action plan.

companyName: MARA Holdings, Inc.

ticker: MARA


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. In general, the Company seeks to address cybersecurity risks through a comprehensive and cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our enterprise security program has been developed based on industry standards, including those published by the International Organization for Standardization (ISO) and the National Institute of Standards and Technology ("NIST").

companyName: SkyWater Technology, Inc

ticker: SKYT


text: This foundation guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We also use third-party assessors and service providers, consultants, and auditors, to support our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks associated with our use of third-party assessors and service providers, such as due diligence, contractual obligations, monitoring and vendor evaluation and qualification.

companyName: Certara, Inc.

ticker: CERT


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's overall cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness. The Company's management reports to the Audit Committee as part of every quarterly scheduled meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad enterprise risk management program.

companyName: Steel Connect LLC


text: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning, and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the team's response readiness capabilities.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: We maintain a threat and vulnerability management program that leverages multiple data sources to proactively identify, assess, and mitigate changing cybersecurity risks. This program incorporates vulnerability scanning and threat intelligence capabilities, which are in place to help safeguard information assets. We also share and receive threat intelligence with government agencies, the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and cybersecurity vendors and leaders in the cybersecurity industry.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We maintain a thorough business continuity and resilience program designed to ensure our operations will withstand significant disruption and minimize impact on our patients and employees in the face of a significant challenge. Using standards developed by Disaster Recovery Institute International (DRII), we regularly conduct a business impact analysis to determine risk level, assess impact severity and prioritize business processes based on company needs.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as the Companies' operations, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to the Companies' executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.

companyName: VIRGINIA ELECTRIC & POWER CO


text: As of June 30, 2024, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, please see "Risk Factors - Risks Related to our Business and Products" in Item 1A of this Form10-K.

companyName: iPower Inc.

ticker: IPW


text: Additionally, we have engaged third-party providers to supplement our response capabilities for both informational and operational technology incidents, as needed.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to a risk assessment incorporating elements of industry-standard frameworks, penetration testing, endpoint detection and response, system log monitoring and alert platform, and security operations center, functioning 24x7. We have an employee training program that includes annual cybersecurity awareness training that is reinforced by frequent phishing campaigns. We also maintain an incident response plan and related processes to help guide our response to cybersecurity incidents.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: The ISO, along with the Bank's Third-Party Oversight Committee, evaluates cybersecurity risks and information systems of third parties whose information systems support important Company operations or with whom the Company has significant business relationships at onboarding, on an ongoing basis and upon termination of the business relationship. Such evaluations may include reviews of reports or performing assessments of a third party's information systems pursuant to established cybersecurity frameworks such as International Organization for Standardization ("ISO") ISO 27001 or Cybersecurity Framework ("CSF") published by the US National Institute of Standards and Technology, as well as reviews of reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants ("AICPA"). When appropriate, the Company may include additional risk mitigation measures in its onboarding requirements for third parties to address any identified risk factors, such as minimum required information security performance agreements to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards, disclosure obligations requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents, and requirements to maintain adequate levels of cybersecurity insurance coverage.

companyName: Finwise Bancorp

ticker: FINW


text: Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents. We also regularly review our incident response and business continuity plans to ensure readiness if and when an incident does occur, and we test our incident response plan through tabletop exercises. Furthermore, we have established a cyber safety program which consists of a team of employees who concentrate on raising cybersecurity awareness in office and home-office environments to educate employees connected to the systems we use on how to identify and report security threats or breaches.

companyName: Installed Building Products, Inc.

ticker: IBP


text: As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers (all of whom are executive officers of our Advisor) under the oversight of our Board. We rely on our Advisor for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Advisor has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Net Lease Office Properties

ticker: NLOP


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us, our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect our company in the future and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled "If our security measures, or those maintained on our behalf, are compromised, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, products, communications or data is compromised, limited, or fails, our business could experience a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, a loss of customers, significant fines, penalties and liabilities, or breach or triggering of data protection laws, privacy policies or other obligations."

companyName: Everpure, Inc.

ticker: PSTG


text: Cybersecurity Personnel Resources The Company's cybersecurity program is managed by our IT department, which is led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University. Our IT department has more than 25 years of combined experience. The members of our IT department have experience with network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also include IT audits and anti-phishing training, as well as server installation, configuration and administration.

companyName: EQC Liquidating Trust


text: The Company does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: ARVINAS, INC.

ticker: ARVN


text: At a management level, our cybersecurity risk management program is led by our Chief Information Officer, who reports to our Chief Executive Officer. Under our Chief Information Officer's leadership, the cybersecurity team implements and provides governance and functional oversight for cybersecurity controls and services. The team's credentials include Certified Chief Information Security Officer, Certified Information Security Manager and Certified Information Systems Security Professional.

companyName: TopBuild Corp

ticker: BLD


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.

companyName: Usio, Inc.

ticker: USIO


text: Our company currently does not have a Chief Information Security Officer ("CISO") due to our size; our Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures and helps identify, assess, and manage the Company's cybersecurity threats and risk. Our DO regularly meets with our third-party IT support firm to discuss cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Information Sharing and Collaboration - We work with government, customer, industry and/or supplier partners, such as the Financial Services Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluation, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.

companyName: MYOMO, INC.

ticker: MYO


text: The Company depends on the confidentiality, integrity and availability of information systems and data. We have systems and processes in place to assess, identify and manage cybersecurity incidents and those systems and processes are integrated into our overall risk management system.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: Pipeline operators have faced and continue to face risks from threat actors that focus their attacks on critical infrastructure assets and disruption to operations. We also face risks from ransomware groups that steal data, encrypt systems and demand a payment. We have cybersecurity protocols and procedures in place—and we rely on third-party software, hardware and vendors—to manage critical aspects of our operations. While we have controls in place to address these risks, if these risks occur, the impact could be material, such as in the event of a cybersecurity incident causing the loss of operational control, disruption of our operations, a demand for ransomware payment or physical damage to our assets or the environment.

companyName: NuStar Energy L.P.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Information Security Steering Committee ("ISSC") is a key element of our cybersecurity strategy. The ISSC is chaired by the CISO and comprises of a cross-functional group from various functions in the company. The ISSC aims to align our security and compliance programs with business objectives. Specifically, the ISSC (i) facilitates identification of risk-based priorities and trade offs; (ii) aims to ensure economies of scale and consistency of information security and compliance across IT assets at the company.; (iii) reviews and approves information security policies; (iv) reviews requests for policy and risk exceptions to provide a "Risk Acceptance Authorization"; and (v) serves as a communications channel and steward to cultivate a culture of trust across the enterprise.

companyName: EQUINIX INC

ticker: EQIX


text: We maintain an incident reporting and escalation process in the event of any observed, detected, or suspected events that we believe may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Our processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Our incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. We determine the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on our business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by our cybersecurity team as well as other members of management and employees with specialized technology or financial knowledge, including our CISO, CIO, and CFO, as applicable. In the event of a material breach, we have a process for escalation to appropriate members of our senior management, and, where appropriate, to our Board and Audit Committee. These groups also collaborate in determining the appropriate response to such events and disclosure of any material breach.

companyName: BGC Group, Inc.

ticker: BGC


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states, notably including California where our banking business is concentrated, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states (including California) have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California where most of our clients are located.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: The Company employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Supplier Risk Management We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. The Verizon Supplier Risk Management Program establishes governance, processes and tools for managing various supplier-related risks, including information security. As a condition of working with Verizon, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: The Information Security Officer has the primary responsibility for managing the Program to identify, assess, manage, and control cybersecurity risk. The Information Security Officer reports directly to the President. The Information Security Officer has approximately 15 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.

companyName: F&M BANK CORP

ticker: FMBM


text: Employee Training Our employees are required to take annual cyber and physical security training designed to help employees guard our cyber and physical data. Employees are tested on this training and cybersecurity performance is considered in annual employee performance reviews.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: For additional information, see "Item 1A. Risk Factors - We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Additionally, our failure to comply with applicable privacy, data security or protection or cyber security laws could adversely affect our business."

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K — "We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation."

companyName: Aptiv PLC

ticker: APTV


text: Social Engineering: Social engineering tactics involve manipulating individuals into divulging confidential information or performing actions that compromise security, often through psychological manipulation or deception.

companyName: International Seaways, Inc.

ticker: INSW


text: The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of the Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Dominion Energy's Board of Directors, including its operations committee (effective in July 2024, previously its finance and risk oversight committee), provides oversight of the Companies' risks from cybersecurity threats. Dominion Energy's Board of Directors as well as its operations committee (effective in July 2024, previously its finance and risk oversight committee) receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity (CISO) and chief information officer. These presentations and reports address a broad range of topics, including the Companies' cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2024 of its third practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including assessments by independent consulting firms and legal counsel of the Companies' readiness and resilience.

companyName: VIRGINIA ELECTRIC & POWER CO


text: The Company is actively engaged in identifying and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. The Company has an enterprise-wide Information Security Program ("Security Program"), which is designed to protect the confidentiality, integrity and availability of customer non-public information. The Security Program was also designed to protect our operations and assets through a continuous and comprehensive cybersecurity detection, protection and prevention program. This program includes an information security governance structure and related policies and procedures, security controls, protocols governing data and systems, monitoring processes, and processes to ensure that the information security programs of third-party service providers are adequate. Our Security Program also continuously promotes cybersecurity awareness and culture across the organization.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: Update and assess our cybersecurity technologies to address threats and vulnerabilities; and Carry cybersecurity insurance to protect against potential losses from incidents. Cybersecurity Risk Assessment Program We do not have a formal cybersecurity risk assessment program.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: PNC's information security program is designed to ensure that PNC follows industry guidance and security frameworks for data protection, system development security, identity and access management, incident management, threat and vulnerability management, security operations management and third- and fourth-party security. Our program is continuously enhanced by threat intelligence, new regulations, industry guidance and disruptive new technologies. The program includes, among other things, annual security and privacy training for all PNC employees, phishing exercises, and informative articles and communications to raise employee awareness.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: The CFO and CEO play a pivotal role in informing the Risk and Information Security Committee on cybersecurity risks. The CFO will immediately notify the Risk and Information Security Committee and Board of Directors of any cybersecurity incident that is determined to be material. The CFO and CEO deliver focused updates to the Risk and Information Security Committee annually, or more frequently as needed, in response to specific incidents or emerging threats. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: FingerMotion, Inc.

ticker: FNGR


text: Our business strategy, results of operations and financial condition have not been materially affected by cybersecurity risks, threats, or incidents in the past, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. We continue to invest in the cybersecurity and resiliency of systems and products and to enhance our internal controls and processes, which are designed to help protect our systems, products, and the information they contain. Nevertheless, we cannot guarantee that we will not be materially affected in the future by such risks or experience future material incidents.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Cybersecurity Risk Management Governance The CISO is responsible for managing the Program. The CISO reports to the Company's Chief Information Officer and regularly engages with the Chief Risk Officer on matters related to the Program. Cybersecurity risks are evaluated by Company management alongside and consistent with other operational risks, with the CISO and the Information Security Team providing subject matter expertise on the identification, assessment, and tracking of cybersecurity risks under the Program. In addition, the Company regularly engages external consultants in connection with evaluating and enhancing the Program and the Company's overall management of cybersecurity threats. For example, the Company engages external consultants to assist the Company in identifying evolving technologies and threats, developing action plans, performing penetration tests, conducting exercises, and conducting periodic reviews.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: eHealth's Head of Information Security reports to our Chief Digital Officer ("CDO") and, with respect to cybersecurity risks, to the Audit Committee of the Board of Directors. Our Head of Information Security focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure. eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, and creates and oversees the privacy program.

companyName: eHealth, Inc.

ticker: EHTH


text: The Company recognizes the importance of a cybersecurity risk management program designed to assess, identify, and manage risk associated with cybersecurity threats. Our cybersecurity risk management program (the "Program") is consistent with the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, which incorporates bank regulatory guidance and principles from the National Institute of Standards and Technology Cybersecurity Framework and includes the following risk-based principles: Identification, measurement, mitigation, monitoring and reporting of cybersecurity threats based on internal and external information sharing and resources; Safeguards designed to protect against identified threats, including documented policies and procedures, controls, and employee education and awareness;


text: Integration with Enterprise Risk Management The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with our Senior Vice President & Chief Information Officer serving on our ERM Committee and our Vice President of ERM serving as the strategic crisis management coordinator under our cybersecurity incident response plan. We have developed processes for managing cybersecurity incidents including clear allocation of responsibilities and defined incident classifications, escalation requirements based on materiality, and prioritization parameters. Our cybersecurity incident response plan is integrated into our ERM Committee risk mitigation action plan process, our Senior Leadership Team (SLT) strategic crisis management action plan process, and our Disclosure Committee protocol for cybersecurity incidents. We also maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data related to our clinical trials and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: ACELYRIN, Inc.


text: We rely on a multidisciplinary team (including from our information security function, management, and third party service providers, as described further below) to assess how identified cybersecurity threats could impact our business.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: The Technology Committee of the Board of Directors oversees the management of risks associated with the Company's products and technologies, including cybersecurity risks related to new product technologies or significant innovations to existing product technologies, in accordance with its charter.

companyName: Gentherm Inc

ticker: THRM


text: Hilltop recognizes the critical importance of protecting company data and the information systems that collect, process and maintain data, and we have developed an enterprise-wide program for assessing, identifying and managing material cybersecurity risks and threats. The systems we utilize include safeguards to protect against or mitigate possible threats, as well as controls designed to ensure accountability, availability, integrity and confidentiality of the data. Security measures are implemented to guard against unauthorized access, alteration, disclosure or destruction of data and systems, including accidental loss and destruction. Our program is supported by management and the board of directors.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors - "Cybersecurity Breaches and other Disruptions to our Information Technology Systems", which is incorporated by reference into this Item 1C.

companyName: ENCORE WIRE CORP


text: As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These regular updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.

companyName: FORD MOTOR CO

ticker: F


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors delegated oversight of Cybersecurity to the Audit Committee. Our board members receive reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as service providers and suppliers, and the current threat environment. These updates are presented by IT third-party experts, finance, and legal departments. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and updates to our cybersecurity risk management and strategy programs. Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; Reviewing our risks and cybersecurity programs and policies; Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs;

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: The Board has delegated oversight of the Program to the ARC, including oversight of the Company's cyber- and technology-related risks and the steps management has taken to identify, assess, monitor, and manage those risks. In addition, the Board has established a reporting structure and cadence related to oversight of the Program, which includes respective oversight responsibilities for the Board, the ARC and management risk committees, including the Technology Risk Committee, the Operational Risk Oversight Committee and the Risk Oversight Committee. Each of the Board and the ARC receive staggered periodic reports on the Program's effectiveness and progress on at least an annual basis.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: The Company periodically engages assessors, consultants, auditors and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The Company attempts to adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. In engaging with third-party providers that will have access to certain sensitive Company data, the Company performs a cross-functional due diligence review and attempts to identify risks posed by engaging such third-party providers, and, where feasible, seeks to obtain contractual commitments from such third parties with respect to such engagement. The Company maintains cybersecurity insurance with coverage for security incident response expenses, certain losses due to network security failures, investigation expenses, privacy liability and certain third-party liability, subject to certain deductibles, exclusions and policy limits.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: During the past fiscal year, based on our current detection and monitoring capabilities, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.

companyName: Enlightify Inc.

ticker: ENFY


text: The Company's Chief Executive Officer is tasked with reporting on cybersecurity measures and issues to the entire board of directors. In the event of a cybersecurity incident, Company policy is for the Company Chief Executive Officer to report the cybersecurity incident to the Company's board of directors and take remedial actions to mitigate and remediate cybersecurity incidents.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: Rekor recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment.

companyName: Rekor Systems, Inc.

ticker: REKR


text: The Board of Directors as a group is responsible for oversight of cybersecurity risks and bears the primary responsibility for oversight of this domain. The Board has delegated to the Audit Committee the primary responsibility of overseeing risk management relating to cybersecurity. The Board of Directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Our Cybersecurity Management Team is responsible for assessing and managing our material risks from cybersecurity threats. The Head of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. Our Head of IT has served in various roles in information technology and information security for over 17 years. Our Deputy General Counsel has over 20 years of experience as an attorney and holds various certifications related to privacy and data protection.

companyName: Arteris, Inc.

ticker: AIP


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, personal information, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").

companyName: Confluent, Inc.

ticker: CFLT


text: We believe cybersecurity is critical to achieving our drug development advancements. As a biotechnology company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Unicycive Therapeutics, Inc.

ticker: UNCY


text: A third-party risk management program is in place ensuring those risks associated with our use of vendors to support our business objectives and strategic initiatives are properly understood and mitigated. Through management's oversight, third-party assessments of vendor's information security practices and protocols, including their readiness to protect against and respond to cybersecurity breaches are performed. Third-party service providers are categorized into tiers in consideration of the risk of a vendor's activities. Vendor due diligence questionnaires are issued seeking to understand a service provider's cyber and information security control environment, as well as their resiliency in the event of an intrusion to their systems. Formalized vendor incident response procedures are in place that support the activities required should a cyber event occur.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: We have put in place a formal incident response plan to address and mitigate potential security breaches in a timely and effective manner. Communication protocols have been established to notify relevant stakeholders, including regulators and customers, as required. Our incident response team conducts regular simulations and exercises to ensure readiness and effectiveness.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Internal Audit, and Legal teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, security, auditing, legal, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: We recognize the critical importance of protecting the confidentiality, integrity and availability of our business operations and systems. With this in mind, we have implemented and maintain an ongoing cybersecurity risk management program, under the oversight of our Board of Directors that is focused on identifying, assessing, managing, and mitigating cybersecurity risk. Our cybersecurity policies, standards, processes and practices incorporate several standards, specifications, and requirements from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: The ISO and the CIO are responsible for implementing and maintaining the Company's cybersecurity risk management program. Information Security is led by the ISO, who reports directly to the President/Chief Executive Officer. The Company's ISO has over 35 years of experience in IT management, information security, and cybersecurity with the Company. The ISO and CIO are responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the ISO or the CIO through quarterly metric reporting to the Information Services Steering Committee. This Committee establishes and oversees policies, programs, and other guidance to provide specific expectations for managing the Company's cybersecurity risk.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: Within the three lines of defense framework for cybersecurity risk, the first line of defense is provided by the Information Technology department, which is responsible for the design and execution of information security practices and risk mitigation, led by the Company's Business Information Security Officer ("BISO"). The BISO reports to the Chief Information Officer, who leads the Company's Information Technology department.

companyName: Capital Bancorp Inc

ticker: CBNK