text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We also have a process for newly-hired employees to participate in security awareness training, and we conduct periodic phishing email simulations. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to ensure the security of our information systems and networks and the confidentiality, availability, and integrity of our data.

companyName: Turtle Beach Corp

ticker: TBCH

secItem: Item 1C


text: Company has established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within its organization and to its Board of Directors, or members or committees thereof, as appropriate. The Company's Board of Directors is responsible for enterprise risk management, including its approach to managing cybersecurity risk, and has delegated oversight responsibility of information security risks to its Audit Committee. Under the Company's framework, cybersecurity issues are analyzed by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to the Company's financial results, operations, and/or reputation are immediately reported by management to the Company's Board of Directors or its Audit Committee, as appropriate, in accordance with its escalation framework.

companyName: OneMeta Inc.

ticker: ONEI


text: The executive management team and the Board oversee the Company's ERM process, including the management of risks arising from cybersecurity threats. The executive management team and the Board each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The executive management team and the Board also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the executive management team and the Board discuss the Company's approach to cybersecurity risk management to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: The Company also engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments and audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: We operate in an environment where cybersecurity risk is dynamic and evolving. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.

companyName: Tradeweb Markets Inc.

ticker: TW


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Aldel Financial II Inc.

ticker: ALDF


text: We seek to continuously improve our program within the NIST framework based on our risk assessment as well as our business needs and industry trends. We also apply administrative, operational and technical security controls to handle and process our data and the data of our members, guests and employees in a responsible and secure manner, including through various internal policies and standards governing information security. We leverage the expertise and advice of third parties to conduct audits, assessments, tabletop exercises, penetration testing and other reviews to assist us in identifying and implementing improvements to our cybersecurity program and aligning it with the NIST framework and our overall ERM program.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: The Company provides regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Xencor Inc

ticker: XNCR


text: Cybersecurity risks are considered as part of the risk management process across all levels of the organization but are also facilitated through a formal process in which the Company identifies significant risks through regular discussions with management and also develops responses and mitigating actions to address such risks. In conjunction with the Company's Internal Audit department, management compiles a report of significant, enterprise risks that is shared with the Company's Board of Directors and its Audit Committee annually or as needed. In addition, cybersecurity and information security risks are among the matters presented by the Chief Technology Officer ("CTO") for discussion with the Company's Board of Directors annually and its Audit Committee quarterly or as needed. The CTO, who reports to the Chief Financial Officer, is responsible for leading the assessment and management of cybersecurity risks. The Company's current CTO has more than twenty years of experience managing technology initiatives in diverse industries, and he designed and led the approach for the modernization of the Company's technology platforms and security posture since 2017.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: Incident Response Training: Regularly assessed incident response preparedness through various incident response and disaster recovery exercises; and Cyber Risk Awareness and Training: Frequent simulation exercises to heighten awareness of cybersecurity threats and educate our user community on preventative measures and reporting protocols. All employees participate in required periodic training with respect to cybersecurity risk and risk mitigation.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our Chief Information Officer, who reports to the Chief Executive Officer, has over twenty years of experience in IT, including IT security. In addition, a member of our board of directors, Hatem Naguib, recently retired from his role as President and Chief Executive Officer of Barracuda, a cybersecurity solutions provider, and brings expertise in IT security.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: Operationalizing Cybersecurity Risk Management We firmly believe – and communicate regularly – that all Tyler team members have a vital role to play in cybersecurity risk management. We identify their responsibilities as falling into three key areas: • Participating in training to identify and promptly report risks; • Staying informed by reading all pertinent information and security communications; and • Actively engaging in ongoing training initiatives.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying IT infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our IT security policies and standards are assessed by our IT security team. Any critical and high-risk levels are identified, documented, addressed and reported to relevant key stakeholders.

companyName: TEAM INC

ticker: TISI


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. We also implement robust network security protections and enterprise hardware for firewalls to safeguard our infrastructure against unauthorized access and cyber threats. Our strategy for 2025 includes leveraging AI and machine learning for enhanced threat detection and response, adopting a Zero Trust architecture, and using quantum-resistant encryption methods for data protection. We also focus on ransomware defense, regular backup and recovery processes, and continuous employee training and awareness programs. Additionally, we ensure compliance with the latest regulations, participate in threat intelligence sharing, and explore emerging technologies like post-quantum cryptography and blockchain security. If our applications fail or our software does not successfully block malicious electronic communications, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Although the Registrants have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect each Registrant's business strategy, results of operations, or financial condition, as further discussed in the risk factor entitled "The Registrants are subject to physical and cybersecurity risks" in ITEM 1A. of this report.

companyName: EXELON CORP

ticker: EXC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology who has over twenty years of experience in IT and Systems Administration.

companyName: Tracon Pharmaceuticals, Inc.


text: Our cybersecurity risk management processes are devised, implemented and assessed quarterly by our Cybersecurity lead, Enterprise Risk Management lead and Head of IT Strategy and Solutions. Our leads have extensive experience in cybersecurity and information technology, and based on their careers, have a deep understanding of our information technology and business needs. Our leads report to the cybersecurity committee monthly regarding emerging risks and the overall cybersecurity environment and immediately when a cybersecurity incident occurs. Our IT heads and Cybersecurity lead closely monitor cybersecurity risks, including our practices and procedures against the cybersecurity environment, including the operation of our incident response plan. Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We strongly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program.

companyName: Aeries Technology, Inc.

ticker: AERT


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats which could result in information security breaches and significant disruption to our business. We have a multi-layer security approach including specialized hardware/software, access protocols, third-party assessments, and regular training. Our servers are hosted by a third-party that provides Service Organization Control (SOC) Type 1 and 2 reports annually with monthly bridge letters and hosts a separate disaster recovery site. Our Firewall, Virtual Private Network, Multifactor Authentication, Email Gateway, Antivirus software, file storage protection software, and other software applications help mitigate cybersecurity risks. Our IT Steering committee reviews our access protocols and systems biannually. Our third-party internal auditing firm provided an assessment of our system design and performed testing. Our IT consultant participates in our weekly operations meetings, requires cybersecurity training, and monitors the results of test phishing and credential harvesting emails.

companyName: FRP HOLDINGS, INC.

ticker: FRPH


text: Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our digital technology group is led by a dedicated Chief Information Security Officer ("CISO"). Our CISO has 16 years of experience as a chief information security officer, over four decades of experience in the energy industry, a degree in computer science, and manages a team at WES that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management. The CISO also leads WES's Cybersecurity Council, which is a cross-functional internal team including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the CISO provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, in our continuing commitment to cybersecurity education and preparedness, we also engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Western Midstream Operating, LP


text: Our Head of Information Technology (IT) oversees overall cybersecurity management, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic, but at least annually, reports to our Board or the Audit Committee of the Board of Directors, or the Audit Committee. The IT security team has over 40 years of combined technology experience, and over 20 years of experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure. The Company's Cybersecurity Committee is comprised of information technology, finance, legal, human resources, and data privacy employees, including the Head of IT. It meets regularly, but at least annually, to review and provide oversight of the Company's cybersecurity risks and data security programs, policies, and strategies. Pursuant to internal policies, the Head of IT will notify the Cybersecurity Committee of significant cybersecurity incidents and breaches. The Cybersecurity Committee (along with the Chief Financial Officer and General Counsel) reviews, analyzes, and responds to cybersecurity incidents and breaches. Additional responsibilities and risk mitigation strategies relate to business continuity and business resiliency capabilities.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Within management, the Group Chief Information Officer of our business units are primarily responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.

companyName: Triller Group Inc.

ticker: ILLR


text: We have in place safety and security measures on our vessels and onshore operations to secure our vessels against cybersecurity incidents. Our processes for assessing, identifying and managing material risks from cybersecurity threats include, but are not limited to: cybersecurity processes designed in accordance with international standards guidelines including the National Institute of Standards and Technology (NIST) Core Framework, ISO/IEC 27001, ISO/IEC 27002, the Tanker Management Self-Assessment (TMSA) 13 Elements, BIMCO, IMO Guidelines and International Ship and Port Facility Security (ISPS) Code, ISA/IEC 62443 for industrial Operational Technology, IACS UR E26/27, and OCIMF SIRE 2.0;

companyName: DORIAN LPG LTD.

ticker: LPG


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company and the Advisers, in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Company, the Advisers and their respective third-party service providers.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: A cybersecurity incident response plan, and incident response policy to respond to cybersecurity incidents; and We mandate that all employees, including corporate personnel with access to information systems, undergo annual data protection and cybersecurity training as well as compliance programs.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our CEO and CFO to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024.

companyName: CFN Enterprises Inc.

ticker: CNFN


text: At the management level, our Head of Information Technology is responsible for assessing and managing risks from cybersecurity threats through oversight of our information technology infrastructure and cybersecurity program. The individual occupying this role has over 20 years of experience in information technology and cybersecurity and has served in senior cybersecurity leadership positions for over 10 years. Our Head of Information Technology conducts bi-weekly meetings with our information technology department to remain apprised of cybersecurity matters. In the event of a cybersecurity incident, our Head of Information Technology may inform our Executive Vice President and Head of Technological Operations and/or Audit Committee, depending on the severity of the incident in accordance with the established severity and response matrix as defined in our incident response plan.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: We also have management-level committees who support our processes to assess and manage cybersecurity risk and related incidents as follows:

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: We maintain a cyber risk management protocol designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Power REIT

ticker: PW


text: We utilize an internal cross-departmental approach to addressing cybersecurity risk, including input from employees, Senior Management, and our Board of Directors. A cross functional Senior Management Cybersecurity Steering Committee devotes resources to cybersecurity and risk management to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is based on the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. Our information technology ("IT") team reviews enterprise risk management-level cybersecurity risks annually, and risks are incorporated into the Enterprise Risk Management Committee framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include several IT Security policies as well as other policies that directly or indirectly relate to cybersecurity, which address topics related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email, and networked devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: Workhorse Group Inc.

ticker: WKHS


text: The CISO has over 39 years of experience working in cybersecurity, risk management, and infrastructure technology and network architecture. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification. The CIO has over 33 years of experience focused on corporate strategy formulation and implementation, IT management including cybersecurity, and business and process transformation.

companyName: JABIL INC

ticker: JBL


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and Senior Director of IT discuss cybersecurity risk with management, including our legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, including multi-layered technical security measures, mandatory user security awareness and training, access control policies and activity monitoring. Additionally, we engage third-party cybersecurity experts to assess the security of our network.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: Our Board of Directors provides direction and oversight over the Corporation's enterprise-wide risk management program, including risks related to cybersecurity. The Risk Committee is responsible for overseeing the Corporation's information security program and execution. The Risk Committee promotes collaboration and cooperation between various elements within the Corporation relative to information security.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors"

companyName: INTELLINETICS, INC.

ticker: INLX


text: The Company's Board of Directors (the Board) is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and are included in the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Company has processes in place for assessing, identifying, preventing, and managing material risks from cybersecurity threats, including related to the use of third party service providers. In addition, the Company leverages the security and monitoring tools of third party service providers. These processes are integrated into the Company's overall risk management program and systems, as overseen by the Board, primarily through the Audit Committee.

companyName: CorMedix Inc.

ticker: CRMD


text: Our Board of Directors is responsible for risk oversight. Our chief executive officer and chief financial officer, with input from and potentially attendance by our third-party information security officer, provide presentations to the Board of Directors on cybersecurity risks or threats as necessary. In the event of a potentially material cybersecurity event, the Chairman of the Board is notified and briefed, and a meeting of the full Board of Directors would be held, as appropriate.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: DTE Energy has experienced, and expects to continue to be subject to, cybersecurity threats and incidents. As of December 31, 2024, cybersecurity risks have not materially affected the Registrants' business strategy, results of operations, or financial condition. For additional discussion of the risks related to cybersecurity threats and incidents, see Item 1A. "Risk Factors."

companyName: DTE Electric Co


text: The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.

companyName: Oak Valley Bancorp

ticker: OVLY


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures are independently audited and assessed on a periodic basis against leading international cybersecurity standards and programs.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: The Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of management's efforts to eliminate cybersecurity risks.

companyName: FUEL TECH, INC.

ticker: FTEK


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. The Committee is comprised of senior executives with risk management and information security expertise. The Information Technology Steering Committee ("ITSC") is a sub-committee of ERMC and is also comprised of senior executives and staff with risk management and information security expertise. ITSC governs the first line of defense cybersecurity risk management activities and furnishes approval items, status reports, and approved Committee minutes to ERMC following a meeting. ERMC governs the second line of defense cybersecurity risk management activities and furnishes key risk indicators, risk assessments, reports, issues and committee minutes to the Board Risk Committee. The CISO assigns quarterly cyber security training to all Company employees and ERMC reviews and approves the training curriculum on an annual basis. Additionally, the CISO ensures the Board receives annual cyber security training.

companyName: Capital Bancorp Inc

ticker: CBNK


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 of Regulation S-K promulgated under the Securities Exchange Act of 1934.

companyName: UNITIL CORP

ticker: UTL


text: Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Additionally, our proactive risk management approach is formed by a variety of established cybersecurity frameworks. The security function housed within our Technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs and in cooperation with our broader risk management team.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: We currently maintain a cyber liability insurance policy. However, our cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.

companyName: PIONEER POWER SOLUTIONS, INC.

ticker: PPSI


text: We recognize the intricate and ever-changing nature of cybersecurity threats. To address this, we have collaborated with external experts, including cybersecurity assessors and consultants. This cooperation involves audits, threat assessments, and consultations to enhance our security measures. These efforts ensure that our cybersecurity strategies adhere to industry best practices and remain effective in safeguarding our systems.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Technology Risk Management Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: Management's Role Managing Risk The Executive Director of IT and the Chief Legal Officer ("CLO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Cyber Incident Response Team ("CIRT") is responsible for the incident response process and provides direction and guidance to users of our information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify and respond to potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Crisis Management Team, Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support or resources are required.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Our Chief Financial Officer ("CFO") and our information technology ("IT") department help identify, assess, and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting threat and vulnerability assessments, and performing audits.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), Vice President of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: NEVRO CORP


text: Safeguarding our operations against cyber threats is a high priority. Recognizing the importance of a strong posture towards cyber threats, our strategy to combat the evolving threat landscape and support the protection of sensitive information includes engaging in: • Incident Response Planning and Data Backups. We maintain and regularly review a detailed incident response plan to help minimize downtime and disruption in the event of a cybersecurity incident and to assess materiality and any related disclosure obligations. We also actively maintain data backup procedures for business continuity in the event of a cybersecurity incident. Examples of our backup procedures and systems include daily server snapshots, database log files, Salesforce backups, and Google Vault. Generally, these backups of critical systems would allow us to restore operation within hours. • Third-Party Managed Monitoring, Detection, and Response Services. We partner with a reputable third-party firm for 24/7 threat monitoring, detection and response. • External Cybersecurity Process Assessments. We also engage third-party experts to conduct periodic process assessments against the U.S. National Institute of Standards and Technology ("NIST") framework to help us evaluate and enhance our cybersecurity practices. • Penetration Testing and Phishing Simulations. We periodically engage experts for penetration testing to identify system vulnerabilities and to simulate real-world cyberattacks. We also conduct quarterly phishing simulations to test our staff's response and to deliver targeted cyber awareness training. • Continuous Improvement and Adaptation. We regularly review and update our strategies to keep pace with the dynamic cyber threat landscape, and to build a resilient and responsive cybersecurity system. Our employees receive monthly training on data protection, threat detection, and incident response. We also provide a forum for employees to report cyber "near misses" to elevate cyber threat awareness across our organization.

companyName: Rayonier, L.P.


text: Our management team has several years of experience and has been trained for various roles in information technology and cybersecurity at numerous technology companies. The team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: • Briefings from internal security personnel; • Threat intelligence and information obtained from governmental, public, or private sources, including external consultants engaged by us; and • Alerts and reports produced by security tools deployed in our IT environment.

companyName: AIRGAIN INC

ticker: AIRG


text: Bio-Techne's General Counsel updates the Audit Committee multiple times per year regarding Bio-Techne's cybersecurity programs, including regularly-tracked metrics on incident response, internal security testing, and measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Audit Committee regularly updates the full Board on these matters. In addition, on at least an annual basis, the CIO provides the full Board with a thorough review of the Company's cybersecurity program, including current status, industry risks and exposure, and future strategy.

companyName: BIO-TECHNE Corp

ticker: TECH


text: We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data. Our security controls include: Network

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: A cyber training and awareness process based on an annual work plan, which includes monthly training, bi-weekly simulations, an interactive magazine sent once a month to all users and a cyber incident simulation for the infrastructure team. The contents are based on relevant market trends.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: We have engaged a managed security services company to provide 24x7x365 monitoring to detect cyber threats and support us in containing and responding to cyber threats. The services provided by the managed security services company include monitoring for and updating us regarding emerging cybersecurity threats, real-time monitoring of our firewalls and other security controls, and support for the development and execution of our Incident Response Plan. The managed security services company performs monthly vulnerability scanning and generates reports. Our cybersecurity team has access to dashboards providing status updates on the managed security services company's cybersecurity-related activity, meets regularly with the managed security services company's staff, and receives regular reporting from the managed security services company.

companyName: Silk Road Medical Inc


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, see "Part I, Item 1A. Risk Factors -- A failure of, or a security breach in a key information technology system or process or other unusual events could compromise our information and expose us to liability, which could adversely affect our business; IT project delays and overruns are possible" which is incorporated by reference into this Item 1C.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: Cybersecurity risk management processes are an integral part of our enterprise risk management which is overseen by the Board and the Technology & Information Security Committee of the Board. The Board oversees the risk management policies of the Company and is responsible for the periodic review and approval of the risk management policies of the company and provides general oversight over the information security and technology programs. The TISC oversees the technology and cybersecurity strategies and their alignment with business strategies, the effectiveness of the information security program, monitors the results of third-party testing and risk assessments and responses to breaches of customer data, among other project management, cybersecurity, and business continuity oversight functions. The Committee meets five times during the year, or more as needed. An information security advisor participates in the meetings and is available to provide additional insights into cybersecurity methodologies, best practices, threat trends, and resource planning.

companyName: ENTERPRISE BANCORP INC /MA/


text: The Company uses a training system to educate new and existing employees on cybersecurity risks. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Cyber Risk Management and Strategy Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company's cybersecurity program utilizes a cross functional, multilayered approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.

companyName: Phreesia, Inc.

ticker: PHR


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption Or Breach In Security" in Item 1A. Risk Factors.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: iii. Oversight of Third-Party Service Providers Our vendor risk assessment program is designed to identify, evaluate, and manage risks associated with third-party service providers. As a part of this program, we regularly review third-party attestation reports, such as SOC 1 and SOC 2, for key service providers to validate the effectiveness of their cybersecurity policies and controls. This ensures alignment with our standards for cybersecurity.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Our CISO and CIO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have an incident response plan that includes immediate actions to contain and eradicate the threat, mitigate the impact, and long-term strategies for remediation and prevention of future incidents.

companyName: HUNTSMAN INTERNATIONAL LLC


text: The full Board is responsible for oversight of cybersecurity risk and receives regular reports from the CIO and the CISO. The CIO and the CISO also present their assessment of material risks from cybersecurity threats to the Board at least annually. The Audit Committee receives periodic reports regarding information technology general controls ("ITGC") in connection with its oversight of internal control over financial reporting. The impact, if any, of cyber incidents on internal control over financial reporting is also discussed with the full Board. The Nomination and Governance Committee considers cyber expertise in vetting nominees for the Board and recommending Committee appointments, and DuPont's Board of Directors has determined that one of its independent board members has cybersecurity expertise.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: Our third-party service providers are primarily responsible for the security of their own information technology environments and in certain instances we rely significantly on third-party service providers to supply and store our sensitive data in a secure manner. All of these third parties face potential risks relating to cybersecurity similar to ours which could disrupt their businesses and therefore adversely impact us. While we provide guidance and specific requirements in some cases, we do not directly control any of these parties' information technology security operations, or the amount of investment they place in guarding against cybersecurity threats. Accordingly, we are subject to any flaw or breaches to their information technology systems, or those which they operate for us, which could have a material adverse effect on our financial condition or results of operations.

companyName: Power REIT

ticker: PW


text: The Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing cybersecurity risks, including implementation of our cybersecurity risk management program. The CISO works in partnership with the information technology, legal, finance, and internal audit functions to review information technology-related policies and internal controls in managing the cyber risk.

companyName: Hillenbrand, Inc.

ticker: HI


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. In particular, the Company has established a cybersecurity incident response plan includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the VP of IT, Director, and President. The Company regularly conducts vulnerability assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Risks from Cybersecurity Threats We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not been material and have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the reputational, operational, legal or financial impacts that may result. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to our Information Technology, Cybersecurity and Data Protection" in this Annual Report.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2023, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.

companyName: Tesla, Inc.

ticker: TSLA


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks. The Audit Committee of the board oversees our risk management program on behalf of the Board of Directors, which focuses on the most significant risks. Audit Committee meetings include discussions of any specific risk areas which are significantly increasing or which are of particular concern.

companyName: Adaptimmune Therapeutics PLC


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's risk management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Risk Committee of the Board of Directors. The Risk Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer ("CISO") and the Head of Information Risk and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Company views information security as a shared responsibility. It requires employees to complete information security and privacy awareness training and sends out regular communications on information security and privacy topics. Developers are trained regularly on secure coding practices and the Company mandates that every business unit perform phishing exercises quarterly. Some employees receive additional in-depth training related to their individual job responsibilities.

companyName: Graham Holdings Co

ticker: GHC


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, be subject to litigation or incur remediation costs or penalties because of the unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Since the Transaction in December 2023 and as a result of the suspension of our operations relating to the Pre-Existing Business, we have no ongoing operations, activities or full-time employees. We currently use third-party vendors and service providers for legal, accounting, executive services and other activities. We do not currently use a third-party sub-contractor to manage Information Technology (IT) issues, including with respect to protection against, detection, and response to cyberattacks, and have not adopted an Information Technology Policy as a result of our size and the status of our operations.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. To prepare and respond to incidents, the Corporation has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. the Corporation engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: We recognize that global cybersecurity threats and targeted attacks are an evolving risk to our data, infrastructure, and overall operations and are committed to addressing cybersecurity risks through a comprehensive, cross-functional approach that reduces security risks, helps ensure business and stakeholder information is handled securely, and effectively responds to cybersecurity incidents when they occur.

companyName: BERRY GLOBAL GROUP, INC.


text: The ongoing management of material risks from cybersecurity threats includes promoting security awareness throughout the Company, such as quarterly employee training, ongoing monitoring for cybersecurity threats and vulnerabilities, incident response planning, and data backup and retention and recovery readiness in accordance with our global business resilience planning policy and program. We have in place a comprehensive Security Incident Response Plan that outlines the policies and procedures to be followed in the event of an incident, including escalation and communication procedures.

companyName: StoneX Group Inc.

ticker: SNEX


text: Management delivers quarterly cybersecurity updates to the Audit Committee, with additional updates provided as significant new threats or incidents arise.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Aurora's Information Security team reports to and is led by our Vice President of Security Engineering, who is responsible for structuring and driving all cybersecurity initiatives at Aurora. This individual regularly reports cybersecurity progress to our Board of Directors, as well as senior leadership across the Company.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Cybersecurity Risk Identification and Management We design and assess our program based on the Center for Internet Security Critical Security Controls Version 8 (CIS V8). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS V8 controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Although we are unable to eliminate all risks associated with cybersecurity threats and we cannot provide full assurance that our cybersecurity risk management processes will be fully complied with or effective, we have adopted policies and procedures that are designed to facilitate the identification, assessment, and management of those risks, including any such risks that have the potential to be material.

companyName: Jingbo Technology, Inc.

ticker: SVMB


text: Reporting to Board of Directors The Vice President of IT Security, in his capacity, regularly informs the CIO, Chief Financial Officer ("CFO") and other executive team leaders of aspects related to cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors where appropriate.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: The Cybersecurity Committee reports regularly to the full Board of Directors, with respect to such matters as are relevant to the committee's discharge of its responsibilities and with respect to such recommendations as the committee deems appropriate for consideration by the Board of Directors. The Cybersecurity Committee also refers to the Audit Committee any matters that come to the attention of the Cybersecurity Committee that fall within the purview of the Audit Committee, including any matters related to the Company's internal control over financial reporting.

companyName: APA Corp

ticker: APA


text: As of May 31, 2025, the Company has not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition. The Company has further disclosed how risks from cybersecurity threats could potentially have a material impact on the Company, including its business strategy, results of operations, or financial condition, in Part I, Item 1A, "Risk Factors" of this Annual Report.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: Our global risk management policy provides a uniform approach for monitoring, identifying, measuring and responding to enterprise-wide risk to minimize potential disruptions to business operations and harm to reputation. Our global risk management policies framework encompasses, enterprise risk management, business continuity and cybersecurity. Cybersecurity risk is a key component of our overall global risk management policy. The Company's cybersecurity program is focused on the following areas: • Governance: In furtherance of the Board's risk management oversight objectives, the Company convenes a Risk Committee comprised of key functional and business leaders. Among other members, the Risk Committee includes our Chief Information Security Officer ("CISO"), our Senior Director of Global Risk and Property Management, our Vice President, Internal Audit, our Vice President, Environmental, Health and Safety and members of the Legal and Compliance teams. This diverse group supports a strong focus on cybersecurity, business continuity, and associated enterprise risks. The Risk Committee's members are charged with, among other things, identifying and assessing significant and emerging risks, as well as working with executive leadership teams to develop and execute plans, responses and mitigation strategies to address significant cybersecurity risks, that could otherwise negatively impact our ability to achieve our objectives. The Risk Committee's cybersecurity management function addresses the Company's information security challenges and risks from various IT-related sources. • Collaborative Approach: The Company has developed and implemented a robust approach to identify, prevent and mitigate cybersecurity threats and incidents. This is supported by clear and direct cross-functional escalation paths to ensure proper handling and analysis so that decisions regarding response, materiality and any resulting disclosure and reporting of such incidents are clearly allocated and can be made in a timely manner. • Technical Safeguards: The Company employs industry accepted security tools, techniques, and system monitoring to protect the confidentiality of our systems and data. Maintaining the privacy and security of our associate, customer, and third-party data is paramount. The Company deploys technical safeguards which include, but are not limited to, encryption, multi-factor authentication, network segmentation, privilege access management and, endpoint detection and response. These safeguards are evaluated on a routine basis with the intention of identifying and remediating potential vulnerabilities and enhancing the overall security framework. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive cyber incident response policy. This policy provides direction and guidance to address and manage security incidents, including identification, classification, and response. • Third-Party Risk Management: The Company maintains a risk-based approach to third party engagement and the cybersecurity risks associated therewith. This approach adheres to Company-policy, which includes regularly evaluating and identifying material risks from cybersecurity threats associated with third parties' access to our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: REGAL REXNORD CORP

ticker: RRX


text: We have also established a cross-functional cybersecurity working team led by our chief financial officer serving as the chair and consisting of executive-level leaders, that is responsible for reviewing, revising and testing our cybersecurity policies and procedures.

companyName: Generation Bio Co.

ticker: GBIO


text: Our Board oversees cybersecurity risk as part of its overall risk oversight. The Audit Committee receives regular briefings on cybersecurity threats, risk assessments, and mitigation activities from management. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing our cybersecurity risk management program and for coordinating incident response. Management reviews significant cybersecurity assessments and reports, allocates budgets, and approves security priorities. Incidents.

companyName: BITMINE IMMERSION TECHNOLOGIES, INC.

ticker: BMNR


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Information Technology Officer.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: We actively monitor and update our IT systems and infrastructure to prevent unauthorized access, viruses, phishing, and other security risks. Our cybersecurity program follows the National Institute of Standards and Technology ("NIST") Cybersecurity Framework standards.

companyName: J M SMUCKER Co

ticker: SJM


text: Synopsys' cybersecurity program is designed to leverage multiple industry-recognized frameworks including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/IEC 27001 Information Security Management Framework, and are assessed regularly by our internal audit department. We track our NIST CSF implementation through periodic third-party maturity assessments that provide the basis for establishing performance goals for the coming period.

companyName: SYNOPSYS INC

ticker: SNPS


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • adoption of frameworks established by the National Institute of Standards and Technology ("NIST") and International Organization for Standardization ("ISO") for a flexible, tailored, and risk-based approach to cybersecurity, helping to ensure a continuous process of identifying, protecting, detecting, responding, and recovering from cyber incidents; • alignment with ISO 21434 (automotive security) and ISO 27001 (information security management) standards, addressing cybersecurity aspects of automotive products and the broader information security management system to establish, implement, maintain, and continually improve confidentiality, integrity, and availability, as well as meeting the cybersecurity standards and product requirements established by our OEM customers; • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems; • providing cybersecurity training programs for employees, management, and directors, including conducting periodic phishing tests to promote awareness for all employees and all contractors with access to corporate email systems; • leveraging industry best practices for incident handling to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident, and participating in an industry information sharing and analysis center; • employing threat intelligence monitoring processes to model, research, and respond to cyber threats in a proactive manner; • closely monitoring emerging data protection laws and implementing changes to our processes accordingly; • undertaking a periodic review of public-facing policies and statements related to cybersecurity; • carrying information security risk insurance that may provide some protection against the potential losses arising from a cybersecurity incident; and • tracking key performance indicators pertaining to cybersecurity incidents, response and recovery, vulnerabilities, and risks. These approaches vary in maturity across the business and we work to continually improve them.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: The Audit Committee of our Board of Directors meets periodically with management to review the Company's overall policies with respect to risk assessment and risk management, including a review the systems and processes implemented by management to identify, assess, manage, and mitigate cybersecurity risks. Our senior management is responsible for the day-to-day supervision of the material risks we may face.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: The Company understands the importance of managing risks from cybersecurity incidents and utilizes a multilayered strategy guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for assessing, identifying, detecting and responding to threats and other potential incidents. Key aspects of our strategy for managing risks of cybersecurity threats include: Timely security patching of endpoints; Network and endpoint-based monitoring with autonomous protection capabilities; Backups which are regularly tested for recovery with key backups hardened against malicious access; Third-party security services for audit, benchmarking, and improvement of our cyber security program;

companyName: FutureFuel Corp.

ticker: FF


text: We have also identified the potential for cybersecurity risks stemming from the use of artificial intelligence (AI) tools developed by third parties. We have implemented policies and training programs to govern the use of AI by our employees. Additionally, the Company's Audit Committee regularly reviews our uses of AI as part of its ongoing risk oversight responsibility.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: Management works primarily with third parties (principally professional services and consulting firms) that assist management in identifying, assessing, and managing cybersecurity risks. To operate its business, the Company utilizes certain third-party service providers to perform a variety of functions and seeks to engage reliable, reputable service providers that maintain cybersecurity programs. The Company is not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: While cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: Arogo Capital Acquisition Corp.


text: Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the operation of our business. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk.

companyName: ARVANA INC

ticker: AVNI


text: To mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network and endpoint monitoring. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: The Company periodically tests its cybersecurity policies, standards, processes, and practices. These testing efforts conducted by our in-house security teams and by third-party security firms include audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Individual controls are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our cybersecurity policies, standards, processes, and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Apple iSports Group, Inc.

ticker: AAPI


text: The Company maintains a continuous monitoring strategy that utilizes advanced tools and technologies to oversee the Company's network infrastructure and digital assets. This includes data loss prevention controls, system log reviews and unusual activities that could indicate a potential security breach. Automated alert systems deployed as part of the Company's monitoring controls are designed to enable rapid identification and escalation of suspicious activities. These systems are configured to detect a range of cyber threats, from malware infections to unauthorized access attempts.

companyName: EVgo Inc.

ticker: EVGO


text: Our Innovation and Technology ("I&T") Committee of the Board is responsible for the oversight of risks from cybersecurity threats. All of our Board members are members of the I&T Committee. At least quarterly, management provides the I&T Committee with updates regarding our cybersecurity risks, threats, and efforts focused on mitigating those risks. These updates are provided by our Chief Technology Officer ("CTO") and our CISO, and include recent developments in cybersecurity, the company's actual experience with cybersecurity incidents, and the systems and processes in place to defend against cyberattacks. Should a material or potentially material cybersecurity incident occur, the Board will immediately be notified of such event by the company's CEO. Our CTO and CISO frequently communicate with affected business and finance leaders regarding any cybersecurity related event.

companyName: TrueBlue, Inc.

ticker: TBI


text: Our Information Security team of the Information Technology department has the direct responsibility for developing, monitoring and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting and training individuals throughout the Company in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT systems, assets and networks are aligned with the parent company and affiliate cybersecurity framework. We engage independent third-party consultants from time to time to assess the adequacy of our cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. The Senior Vice President – Chief Information Officer, or CIO, who reports to the Executive Vice President and Chief Operating Officer, oversees this group and is responsible for managing the program, in collaboration with our business and functions. Our CIO has served in that role with us since 2004 and has extensive experience with cybersecurity and information technology at the Company.

companyName: Waste Connections, Inc.

ticker: WCN


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. The Company has established controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company has also established a process to validate the aforementioned controls are in place and the results are being reviewed as a part of the overall company risk assessment. The Company's Incident Response Plan (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Our management recognizes the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess and manage material risks arising from cybersecurity threats.

companyName: Strawberry Fields REIT, Inc.

ticker: STRW


text: 10 The Procter & Gamble Company A central team within the Company leads enterprise-wide incident investigations and response, assisting and consulting on cyber security incidents impacting individual Organizational Units. Alerts of potential incidents can arise from security tool alerts, employee reports, threat intelligence sources, threat hunting activities or external entities, among other sources. The Company's Security Operations Center initially responds to incident alerts and notifies central experts to any potentially significant cybersecurity incidents. Members of the Security Operations Center and relevant response teams work to contain and eradicate potential and identified threats and support the system's recovery efforts, advised as needed by the Legal department and other Company experts. Incidents are communicated to the CISO and other members of management, including the Company's Ethics & Compliance Committee, as well as the Audit Committee of the Board, based on documented escalation criteria. The central enterprise team also regularly reviews incident reports to update the CISO. As described above, both the CIO and CISO report information about the Company's identification and management of cybersecurity risks to the Audit Committee.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: Board of Directors provides oversight of our cybersecurity program through an annual risk review. On an annual basis, cybersecurity risk and mitigation strategies are reviewed as part of management's reporting to the Board of Directors, which includes reporting significant business risks, including cybersecurity mitigation strategies employed to manage these risks, and a review of any emerging risks. Annually, management is to provide an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks, and a summary of key performance indicators. As of the date of this filing, we have no t experienced any material cybersecurity incidents.

companyName: Sundance Strategies, Inc.

ticker: SUND


text: Our Risk Assessment Committee, which is comprised of individuals from our information technology, risk management, and internal audit departments, meets periodically to discuss our exposure to cyber risks as well as our efforts to mitigate the potential impact of such risks to our business or otherwise transfer such risk, including through the use of insurance products. Additionally, as part of our risk-based approach to cybersecurity: • our information technology systems and internal controls undergo annual audit; • we conduct annual penetration testing in consultation with a third-party consultant to assess any vulnerabilities in our systems and utilize the results to evaluate and remediate any identified issues; • we perform daily vulnerability scans of all computers within our system; • we use single sign-on and multi-factor authentication; • we conduct diligence on, and seek engagements of, sophisticated, cloud-based third-party service providers for critical functions; • we have implemented a zero-trust security model with group-based access to resources on our network; • we monitor applicable privacy and data protection laws and regulations and implement changes, as necessary, to remain in compliance; • we maintain cyber liability and crime insurance policies; • we maintain immutable backups of the files on our systems to aid in the recovery of our data and for operational continuity, in the event of an incident or incursion; and • our employees participate in mandatory cybersecurity training, including a recurring cyber-phishing awareness campaign designed to assess our employees' awareness of and responses to phishing requests.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Digital and Information Officer.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Our Audit Committee and board of directors provide ultimate oversight of our cybersecurity risk management. Our Chief Information Security Officer, who also functions as our Chief Information Officer ("CIO"), provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as our processes, program and initiatives for managing these risks. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.

companyName: STRYKER CORP

ticker: SYK


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board’s continuing education on topics that impact public companies.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: CDT Equity Inc.

ticker: CDT


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, periodically conducts an internal assessment of different systems to assess our risk management processes, including cybersecurity risk management. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter. As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging third-party vendors and key suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity related risks, see "Risk Factors—Risks Related to Information Security and Privacy—Our Internal Information Technology Systems, Or Those Of Our Collaborators Or Other Contractors Or Consultants, May Fail Or Suffer Security Breaches, Which Could Result In A Material Disruption Of Our Product Development Programs."

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Information Security Program Allstate has implemented a robust Information Security Program to manage material risks from cybersecurity threats. The Company's Program uses a risk-based, defense-in-depth approach to identify, assess and manage cybersecurity risks to the Company's information assets and systems, enabling the business to achieve its objectives. The Information Security Program is aligned with industry best practices and standards including the ISO 27001/27002 standards, the Control Objectives for Information and Related Technologies The Allstate Corporation 31 Framework and the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: ALLSTATE CORP

ticker: ALL


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).

companyName: CVR ENERGY INC

ticker: CVI


text: As part of the above processes, we periodically engage with consultants, auditors and other third parties, including having independent third-party consultants review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • artificial intelligence based managed detection and response system that provides 24 7 monitoring of our networks, endpoints, and cloud environments; alerts from this system are handled by an external 24x7 staff that reviews the alerts and acts where necessary; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management evaluation process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this 2023 10-K Report, including the risk factor captioned "We may not be able to maintain effective and efficient information systems or properly safeguard our information systems." While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: BurgerFi International, Inc.


text: The Company's Information Technology Manager informs the Audit Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes.

companyName: Sow Good Inc.

ticker: SOWG


text: Risk Management and Global Strategy We have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard (PCI DSS). Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: Board of Directors Oversight of Cybersecurity Risk Management The a udit committee of our Board has oversight of our cybersecurity risks. The audit committee receives quarterly updates from CIM Group, including one or more representatives from the Cybersecurity Committee and Subcommittee, with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the audit committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 of Form 8-K and shall oversee the Company's response to such matter.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF