text: Protection of our customers' data is a fundamental priority for our Board and management team. Our risk management team is integrated into our CIS function and is led by our CDO and CISO. The risk management team reports to the CISO and has combined experience in information security, governance, and compliance, including domains such as engineering, architecture, cybersecurity, and privacy. This team is responsible for defining the program, cybersecurity governance, and gathering insights related to assessing, identifying, and managing cybersecurity threat risks, their severity, and mitigations.

companyName: KROGER CO

ticker: KR


text: We assess the cybersecurity practices of our third-party vendors and service providers, including conducting due diligence on vendors before engaging their services and monitoring their compliance with our security requirements.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK

secItem: Item 1C


text: Autoliv maintains a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats as an integrated part of the Company's overall operations. The objective is to provide protection against cybersecurity threats to our employees, operations, data, and products.

companyName: AUTOLIV INC

ticker: ALV


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: We have not previously been materially impacted by any previous cybersecurity incidents. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial Governance Management

companyName: Collective Audience, Inc.


text: The Company relies extensively on various information systems and other electronic resources to operate its business. In addition, nearly all of the Company's customers, service providers and other business partners on whom the Company depends, including the providers of the Company's online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of the Company's business, as a financial services provider, and the Company's relative size, make the Company and its business partners high-value targets for these bad actors to pursue. See "Item 1A. RISK FACTORS—Operational, Strategic and Reputational Risks".

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: We have experienced, and will continue to experience, cyber incidents in the normal course of our business. Notwithstanding the approach we take to cybersecurity risk management, we may not be successful in preventing or mitigating a cybersecurity incident that could have a significant adverse impact on our business and reputation. See "Risk Factors" above for additional information on risks related our business, including from risks related to cyber attacks, data security incidents, information and system breaches, and technology disruptions and failures. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: Understanding the potential risks associated with third-party service providers, we shall implemented stringent processes to oversee and manage these concerns. We shall conduct thorough security assessments before engaging with any third-party provider and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This involves quarterly assessments by our management and continuous evaluations by our security engineers. This approach is designed to mitigate the risks of data breaches or other security incidents originating from have not encountered cybersecurity issues that have significantly impacted our operational performance or financial status.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise-wide risk management and compliance program and overseen by the Audit Committee, and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes and procedures by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include our incident response process, tracking in our centralized risk repository, and our vulnerability management process. Our Incident Response policy describes and supports the activities we take to prepare for discovery, response, and recovery from cybersecurity incidents, which include processes to determine severity, escalation, and response to incidents, as well as those necessary to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Lyft, Inc.

ticker: LYFT


text: We plan to design our risk management program to also assess third-party risks, and we plan to perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we plan to perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: LIBERTY STAR URANIUM & METALS CORP.

ticker: LBSR


text: We periodically engage external advisors to perform an independent assessment of the maturity of Nasdaq's information security programs, and compare our programs to our financial and technology industry peers. Nasdaq's InfoSec program has demonstrated increasing levels of maturity year-over-year for every InfoSec department.

companyName: NASDAQ, INC.

ticker: NDAQ


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: Our Board oversees the implementation of Hines' cybersecurity risk management program and receives periodic reports from Hines' Chief Technology Officer (CTO) and Chief Information Security Officer ("CISO") regarding the effectiveness of Hines' cybersecurity risk management program. Additionally, our Board will receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Our Board of Directors is responsible for ensuring that the Company has effective procedures for assessing and managing risks to the Company's operations, financial position, and reputation. The Board has charged the Audit Committee with responsibility for monitoring the Company's processes and procedures for risk assessment and risk management. Cybersecurity represents an important component of our overall approach to enterprise risk management. The Audit Committee receives regular reports, including twice annually from our Chief Information Security Officer ("CISO"), on a wide range of cybersecurity topics, including our cybersecurity program's performance, emerging threats, capability enhancements, recent developments, evolving standards, technological trends and other relevant topics. The Audit Committee also receives an update at least quarterly on the Company's cybersecurity metrics and key performance indicators. Executive leadership is continually apprised of developments pertaining to our cybersecurity program through electronic communications and senior leadership meetings.

companyName: Crane NXT, Co.

ticker: CXT


text: We maintain a comprehensive cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company's and our clients' information. Cyber security is also an inherent consideration for our data and AI-led solutions. Specifically, there is a heightened focus on institutionalizing a Responsible AI framework to proactively identify and mitigate data protection and privacy risks. We aim to continually strengthen our cybersecurity posture and protocols by investing in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve. No assurance can be given that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: Further, Starwood Capital utilizes on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed third-party security service providers. These third parties collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel of Starwood Capital can identify and analyze threats. With respect to the software platforms that are hosted by third parties, Starwood Capital utilizes an external vendor risk management platform to evaluate, rate, monitor and track vendor risk. The security practices and processes of our third-party service providers are monitored regularly. In addition, we have engaged a third-party to evaluate and review the remediation of cyber risks of our third party service providers, including financial service providers, property managers and professional service firms. For any hosted applications, Starwood Capital inquires if the vendor issues a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, Starwood Capital takes additional steps to assess its cybersecurity preparedness and assess the relationship on that basis. Starwood Capital's assessment of risks associated with the use of third party service providers is part of Starwood Capital's overall cybersecurity risk management framework.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels receive regular mandatory training on our cybersecurity policies and practices.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Our offices are physically secured with key card access controls for parking and floor access. In addition, security guards monitor building reception areas and parking garages, and receptionists are located in our lobbies to greet visitors. The Company engages assessors, consultants, auditors, or other third parties in connection with its cybersecurity processes.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and cybersecurity risk has increased in recent years. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. See Item 1A. "Risk Factors" for further discussion of the material risks associated with an interruption or breach in our information systems or infrastructure.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our cybersecurity management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: In addition, we provide regular security awareness education and training for all employees and consultants, conduct internal "phishing" testing and training for "clickers," require mandatory security training for all new hires and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: The execution of the Company's cybersecurity processes is overseen by a committee that includes our Chief Information Security Officer ("CISO"), Chief Financial Officer, Chief Operating Officer, General Counsel and Chief Technology Officer ("CTO"). This committee is responsible for the overall cybersecurity strategy and approving the cybersecurity processes, policies, and procedures, including the InfoSec Roadmap. The committee receives regular reports on the InfoSec strategy, risks, and mitigation efforts. It is also informed of any potential reportable information security incidents and is responsible for assessing the impact and approving remediation plans, as well as escalating to the Audit Committee or Board of Directors. Overall implementation of the cybersecurity strategy is executed across the enterprise by Recursion's InfoSec team, which is supervised by the CISO.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: We consider cybersecurity risk to be an important potential risk to our business. Our Audit Committee maintains oversight of cybersecurity and other information technology risks affecting us. As such, on a quarterly basis, or as frequently as required, management provides reports regarding cybersecurity and other information technology risks to the Audit Committee, which, pursuant to its charter, is generally responsible for the oversight of many of our broader risk assessment and risk management policies. These management updates are designed to inform the Audit Committee of any potential risks relating to information security or data privacy and may outline any relevant mitigation or remediation tactics being implemented.

companyName: CIVITAS RESOURCES, INC.


text: Cybersecurity risk management is integrated into the Company's overall enterprise risk management (ERM) process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by our information technology security team; (ii) internal and external penetration tests are performed to identify any vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cybersecurity Management report on cybersecurity risk management and related matters to the board of directors and the audit committee, as part of their ongoing evaluation and oversight of overall enterprise risk.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Reporting to the Board. As noted above, our CIO, Director of Cybersecurity, and cybersecurity team provide quarterly updates and reports to our Audit Committee on cybersecurity risks as well as a review of the processes described above. Our management personnel are also required to provide more frequent updates to the Audit Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Management's Role: Day-to-day management of cybersecurity is handled by our Chief Executive Officer ("CEO"), who does not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, "Other Operational Risks."

companyName: Encompass Health Corp

ticker: EHC


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Cipher Digital Inc.

ticker: CIFR


text: SelectQuote has a network of third-party, industry leading, security experts whom they engage to independently test, assess and evaluate our risk management practices. We routinely engage in risk management activities designed to identify potential vulnerabilities; which, if identified, are planned for remediation.

companyName: SelectQuote, Inc.

ticker: SLQT


text: Our Chief Business and Legal Officer and our security governance steering committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Business and Legal Officer and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their work overseeing, working with, and delegating daily operations to the IT/IS team, as well as their work developing and implementing information security policies, consistent with the IT/IS processes. These policies are reviewed at least annually with updates authorized and approved by the security governance steering committee.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Our CISO is responsible for our overall information security strategy, policy, security engineering, operations, cybersecurity threat detection and response. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. Global Information Security team members provide regular reports to our CISO with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents, and otherwise aid our CISO in operating the ISMS. Global Information Security team members have relevant education, certifications, and industry experience.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Cybersecurity Risk Management and Strategy GitLab's cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats. Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact. Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management. We also make judgments based on current data, assumptions about the risk, the company's risk tolerance, impact to confidentiality, integrity and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk. Our global incident response team iteratively evaluates security events for impact, using both qualitative and quantitative factors. Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable.

companyName: Gitlab Inc.

ticker: GTLB


text: Furthermore, our Board of Directors takes a proactive stance in overseeing our annual enterprise risk assessment. This comprehensive evaluation encompasses key risks, including those associated with security, technology, and cybersecurity threats, demonstrating our commitment to robust governance and risk management.

companyName: SunOpta Inc.

ticker: STKL


text: We engage third parties in connection with our risk assessment processes. We require each third-party service provider to adhere to our internal security policies and certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. These service providers are primarily overseen by our Vice President of Information Technology ("VP of IT") and assist us in monitoring and testing our safeguards, including execution of external penetration testing and ongoing real time vulnerability assessments through our extended detection and response processes to identify cybersecurity threats. We conduct risk assessments in the event of a material change in our business processes that may affect information systems that are vulnerable to such cybersecurity threats through our normal change control processes. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Arq, Inc.

ticker: ARQ


text: Our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO") are responsible for our company's overall information security activities and cyber risk programs. Our CISO reports to the CIO and leads our cyber and data-related incident response activities. Our current CIO and CISO each have more than 25 years of experience in the digital and information technology field.

companyName: WORLD KINECT CORP

ticker: WKC


text: In addition, our management team has established an Enterprise Risk Management Program (the "ERM Program"), which includes processes designed to assess, identify, manage, categorize, and monitor key current and evolving risks facing AppFolio, including cybersecurity risks. Management is made aware of current and evolving cybersecurity risks through ERM Program reporting and periodic updates at weekly executive leadership team meetings. In the event of a material or potentially material cybersecurity incident, senior members of management are promptly informed of such incident and oversee response and disclosure efforts pursuant to the terms of a documented incident response plan.

companyName: APPFOLIO INC

ticker: APPF


text: The Information Technology team is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy are led by our Vice President of Information Technology, and our Manager of Security. Such individuals have over 50 years of work experience, collectively, in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as relevant degrees and certifications.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Should a security breach or incident occur, the Chief Information Officer (the "CIO") in collaboration with the Company's General Counsel, Chief Accounting Officer (the "CAO") and Chief Operating Officer (the "COO") will evaluate the materiality of any specific incident. The Company's Chief Executive Officer (the "CEO") and Chief Financial Officer (the "CFO") will ultimately decide if an incident is material. Considerations of materiality will include a variety of factors, including, for example, the extent of expected financial cost, customers impacted, operational impacts, and/or data exposed or lost as a result of the incident.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, without limitation, intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal data (including sensitive personal data such as biometric data and employment-related data) ("Information Systems and Data").

companyName: Veritone, Inc.

ticker: VERI


text: We have a third-party risk management program. Prior to engaging third-party service providers, we conduct a cybersecurity risk assessment and utilize a third-party exchange service to gather security posture ratings across all of the third party's IT security, compliance and data privacy domains.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities. • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including monthly anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.

companyName: Ventas, Inc.

ticker: VTR


text: Our Chief Executive Officer oversees our cybersecurity program and leads our incident response efforts. The incident response team is cross-functional, drawing members from cybersecurity, IT support, mining operations, software engineering, compliance, legal, contractors, and partners.

companyName: Advanced Biomed Inc.

ticker: ADVB


text: ASB relies on its information technology systems and networks in connection with many of its business activities. Some of these networks and systems are managed by third-party service providers and are not under the Bank's direct control. The Bank has implemented processes to manage the cybersecurity risks associated with its use of third-party service providers.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.

companyName: Citi Trends Inc

ticker: CTRN


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While as of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company's business strategy, results of operations or financial condition, we have experienced cybersecurity incidents from time to time, and any future incidents have the potential to have a material adverse effect on our business strategy, results of operations and/or financial condition. Please refer to "Risk Factors— Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our or our third-party service providers' information technology systems could compromise sensitive information related to our business or prevent us from accessing critical information and subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline." under Item 1A. of this Form 10-K for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: We have an incident response team comprised of our CISO, executive leaders, management, and internal and external legal counsel, whose primary responsibilities include: • evaluating and validating the impact of an incident; • approving certain incident response countermeasures and remediation actions; • escalating incidents and response countermeasures for approval; and • acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees twice per year, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: The Operational Risk Committee also includes subcommittees which, among other things, address security issues and concerns, pursue security-related program enhancements, address fraud trends, provide input on fraud strategy, weigh the impacts of fraud risk on customers, business clients, and the LOB, and cascades awareness of fraud risks across Key.

companyName: KEYCORP /NEW/

ticker: KEY


text: Management plays a key role in incorporating cybersecurity risk considerations into our boarder risk management framework and ensuring that essential priorities are communicated to the appropriate personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including but not limited to reporting cybersecurity incidents to the audit committee as described above. Our management team also evaluates the potential impact of cybersecurity incidents. If any such incidents should occur, management's evaluation considers factors such as the nature. scope and materiality of the incident, and its effects on the Company's operations.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: As part of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The board of directors oversight of cybersecurity risk management is supported by the Audit Committee of the board of directors (the "Audit Committee"), which interacts with our Enterprise Risk Management function, our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including management's Cybersecurity Council. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, and controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: We have established and maintains comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Marpai, Inc.

ticker: MRAI


text: As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior Nuveen Real Estate professionals and our Advisor is a subsidiary of TIAA. As such, we are reliant on TIAA for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details TIAA has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Nuveen Global Cities REIT, Inc.


text: Any cybersecurity incidents, whether or not successful, could result in our incurring additional costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access to our computer systems, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving and the bad actors are becoming increasingly sophisticated, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Audit Committee receives updates from management on a regular basis of our cybersecurity threat risk management and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation related goals, our incident response plan and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also receives materials, including a cybersecurity briefing, indicating current and emerging cybersecurity threat risks and describing the Company's ability to mitigate those risks.

companyName: AMEDISYS INC


text: Our Chief Information Officer and Chief Information Security Officer have the primary responsibility for assessing and managing our material risks from cybersecurity threats. Both the Chief Information Officer and Chief Information Security Officer have extensive experience in running and managing a cybersecurity program both in commercial enterprises and government agencies. In assessing and managing our material risks from cybersecurity threats the Chief Information Officer and Chief Information Security Officer utilize real time monitoring tools, alerts, and dashboards, proactively hunt for threats, and assess capabilities through penetration testing and table top exercises, as well as access and utilize third party resources.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Information Technology or IT, department assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program.

companyName: Semler Scientific, Inc.


text: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management continuously evaluate and addresses cybersecurity risks in alignment with our business objectives and operational needs. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee")

companyName: HWH International Inc.

ticker: HWH


text: The Company utilizes widely-recognized frameworks based on practices believed to be effective for managing cybersecurity risk, including the development of an organizational understanding of systems, assets, data and capabilities, and the development and implementation of safeguards and processes designed to ensure delivery of services and to detect, respond to and recover from cybersecurity events. Significant time and resources are devoted to the protection of the Company's systems and data, including the staffing of an experienced internal cybersecurity team, the use of a variety of preventative, detective and recovery tools, and engagement with external service providers to bolster the Company's cyber defense and response capabilities. Our Chief Information Officer (CIO) has more than 30 years of information technology and cybersecurity experience and our Chief Information Security Officer (CISO) has more than 15 years of direct cybersecurity experience. In addition, the Company's Internal Audit team includes members with information technology and cybersecurity expertise and training.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: The CISO is responsible for identifying technology and cybersecurity risks and is responsible for the controls to manage threats. To help safeguard the confidentiality, integrity and availability of our infrastructure, resources and information, we maintain an Information Security Program designed to prevent, detect, and respond to cyberattacks. The ITSC and Board of Directors is periodically provided with updates on the Information Security Program, recommended changes, cybersecurity policies and practices, ongoing efforts to improve security, as well as our efforts regarding significant cybersecurity events.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's Chief Information Officer ("CIO") and the Company's Chief Information Security Officer ("CISO"), who reports to the Company's CIO. The CIO and his direct reports, including the CISO, discuss action items related to risks at a standing monthly meeting. The CISO and many members of his team have multiple decades of cybersecurity related experience. Risk reporting is provided at monthly meetings of the firm's cross-business Cybersecurity Committee and periodic presentations to the firm's Risk Management Committee, at which many members of the Company's senior management are present.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: The Audit Committee of our Board of Directors receives regular reports, including an annual cybersecurity maturity assessment and quarterly scorecards, from our Chief Technology and Innovation Officer. Those reports cover topics related to information security, privacy, and cyber risks and our risk management processes, including the status of any recent cybersecurity events, the emerging threat landscape, and the status of capital investments in our information security infrastructure. The Audit Committee provides regular reports to the full Board of Directors. In addition, the Audit Committee and the full Board of Directors have authority to engage external consultants, including legal, accounting or other advisors, such as cybersecurity firms, in carrying out its oversight of our cybersecurity risk management program. Likewise, the Audit Committee or the Board of Directors may request members of management or others to attend meetings at which cybersecurity risk management is addressed.

companyName: Mid-America Apartments, L.P.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the Vice President of Finance, who reports to the CEO. The Vice President of Finance has over 15 years of experience as a Certified Public Accountant specializing in internal controls and U.S. GAAP. The CEO has nearly 25 years of experience in management including serving as a CFO and CEO of publicly traded life science companies as well as holding an MBA for New York University's Stern School of Business. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable. • Technical Safeguards: The Company implements and maintains technical safeguards designed to protect the Company's information systems and data from cybersecurity threats, including perimeter and web application firewalls, proxy, intrusion prevention and detection systems, anti-malware, endpoint detection response functionality, data loss prevention systems, security incident event management, geo-blocking and access controls. Such safeguards are generally evaluated through internal security testing, third party penetration testing and vulnerability assessments, as well as outside audits and certifications, and revised as warranted. The Company seeks to comply with the cybersecurity framework guidelines issued by the NIST and ISO. • Education and Awareness: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery to equip Company employees with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Incident Response and Recovery Planning: The Company's Security Operations Center ("SOC"), reporting to the CISO, provides 24x7 incident monitoring. If an incident occurs which SOC determines qualifies as a "critical risk" according to predetermined criteria, the SOC engages an incident management team to assist with evaluating, responding to and managing the response of the incident. The Company has established and maintains comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents. The Company conducts periodic drills and tabletop exercises to test these. • Third-Party Risk Management: The Company conducts initial, and on a periodic basis, subsequent risk evaluations of vendors that satisfy certain preestablished criteria classifying such vendors as presenting higher potential cybersecurity risks based upon vendor access to or provision of information systems or data to the Company that present significant potential risks.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Furthermore, our ERM Council annually reports its activities either directly to the Board of Directors or through the Audit and Finance Committee.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: The SIRT is composed of employees with expertise in various aspects of EVgo's operations including information security, information technology, DevOps, legal, and EVSE engineering, as well as senior leaders, including EVgo's President, Chief Financial Officer and Chief Legal Officer.

companyName: EVgo Inc.

ticker: EVGO


text: Our information technology systems ("IT Systems") play a central role in running nearly all aspects of our business operations. Our IT Systems are used for a variety of critical business functions including, but not limited to, internal and external communications, managing our documents and records, supporting functional and enterprise business processes and providing shared work environments across various business functions. Therefore, responding efficiently and effectively to cybersecurity incidents and threats is an important component of our enterprise risk management strategy. In order to respond to such incidents and threats, we have implemented a carefully designed Incident Response Plan ("IRP").

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) the Company's information governance and cybersecurity policies and programs; and (iv) major legislative and regulatory developments that could materially impact the Company's data privacy and cybersecurity risk exposure. On a quarterly basis, our General Counsel, Chief Financial Officer ("CFO") and CIO have been and are responsible to report to the Audit Committee on information technology and cybersecurity matters, including key risks, a detailed threat assessment relating to information technology risks, as applicable, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, and significant legal developments that could materially impact the Company's cybersecurity risk exposure.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Board of Director Oversight The Audit Committee of the Board of Directors has the primary responsibility for cybersecurity risk oversight, including risk priorities, resource allocation, and oversight structures. The Audit Committee and Board of Directors receive regular reports from the CIO on a variety of topics including cybersecurity strategy, the threat landscape, recent developments and trends, and key initiatives. Our incident response plan includes documented protocols which govern established reporting thresholds for escalating cybersecurity incidents within the Company and where appropriate, to the Audit Committee or full Board of Directors.

companyName: FRANKLIN COVEY CO

ticker: FC


text: The Company's cybersecurity principles, goals and targets are defined in a policy approved by the Board of Directors (the "Policy"). This Policy is anchored in a risk-based approach based on industry standards to balance the level of cybersecurity against the risks faced by the Company. Material risks are managed by both internal resources and third-party contractors. The Company believes that effective information security management is necessary for the secured sharing and protection of information within the Company's cyberspace.

companyName: Bit Digital, Inc

ticker: BTBT


text: Our team of cybersecurity professionals are responsible for maintaining a global information systems environment that focuses on least privilege, least functionality, and network segmentation throughout the landscape using a layered approach (i.e. a defense-in-depth strategy). This includes a security operations center and cybersecurity engineers who provide 24/7 network monitoring.

companyName: ALBEMARLE CORP

ticker: ALB


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Barings BDC, Inc.

ticker: BBDC


text: See "Item 1A - Risk Factors" beginning on page 16 for additional information on cyber attacks and other cybersecurity risks the company faces.

companyName: CME GROUP INC.

ticker: CME


text: Our Board of Directors, or Board, addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Audit Committee receive scheduled updates from senior management. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Management Committee Oversight The Company has established an Information Technology and Security Management Committee consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, and Cybersecurity. These functional areas are led by qualified financial service technology professionals, with extensive certifications and advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The committee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the management Risk Committee to provide a second line review in alignment with Enterprise Risk functions. All Information Security activity is led by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting on cybersecurity matters to the Board. The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial services, supported by a team with various security, technical, risk, audit and leadership certifications. Management provides cybersecurity statistics and details to the board monthly.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Our board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. Our board of directors oversees the ERM Program, the Enterprise Security Program and Information Security through policies and principles including the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The board of directors oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.

companyName: Federal Home Loan Bank of Topeka


text: Our Information Security team, led by our CISO, is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. The Information Security team works collaboratively across the Company to understand the potential impacts of a cybersecurity incident and prioritize mitigation and other measures based on, among other things, the materiality to our business. The Information Security team has established processes designed to monitor threats in the cybersecurity landscape which include interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending industry specific security conferences and trainings. The team regularly monitors our internal network and customer-facing network to identify any security issues. In addition, the Company augments the team's monitoring via the engagement of external vendors who provide continuous threat monitoring services of the Company's environment.

companyName: BROOKLINE BANCORP INC


text: Our cybersecurity and compliance team regularly collects data on cybersecurity threats and risk areas, monitors our systems, and conducts testing to assess our processes and procedures and the threat landscape. Our VP, CIO and CISO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Risks from Cybersecurity Threats Nordstrom has not experienced any cybersecurity incident that has materially impacted, or that is reasonably likely to materially impact, our operations, financial condition or cash flows.

companyName: NORDSTROM INC


text: We leverage third-party expertise to audit and test our cybersecurity program and perform employee awareness training. These include periodic reviews of cybersecurity threats and related controls, including review of periodic penetration testing conducted by independent third parties.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, law enforcement, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: awareness training of our employees, incident response personnel, and senior management; and can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Board considers cybersecurity risks as part of its risk oversight.

companyName: NEXGEL, INC.

ticker: NXGL


text: The cryptocurrency earned from the Sphere 3D's mining operations is held in a wallet, in which the Company holds the cryptographic key information and maintains the internal recordkeeping of the cryptocurrency. The Company's contractual arrangements state that Sphere 3D retains legal ownership of the cryptocurrency; has the right to sell, pledge, or transfer the cryptocurrency; and benefits from the rewards and bears the risks associated with the ownership, including as a result of any cryptocurrency price fluctuations. Sphere 3D also bears the risk of loss as a result of fraud or theft unless the loss was caused by the Company's gross negligence or the Company's willful misconduct. The Company does not use any of the cryptocurrency resulting from the Sphere 3D MSA as collateral for any of the Company's loans or other financing arrangements, nor does it lend, or pledge cryptocurrency held for Sphere.

companyName: American Bitcoin Corp.

ticker: ABTC


text: We rely on the digital technology of the Investment Manager to conduct our business operations and engage with our clients and business partners. The technology that our Investment Manager, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Group, including our business strategy, results of operations, or financial condition.

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: Key components of the Company's cybersecurity program: • Risk Management: The Company continuously assesses and mitigates cybersecurity risks across the organization by leveraging industry best practices and frameworks such as NIST Cybersecurity Framework. • Governance and Oversight: The Company's Board of Directors (the Board) regularly reviews cybersecurity matters, ensuring alignment with business objectives and regulatory requirements. A designated Information Technology Strategic Committee, which includes many subject matter experts from the Board and Executive Management, meets quarterly to provide additional focus and expertise in this area. • Security Controls: The Company has implemented robust technical and procedural controls to protect information assets, including firewalls, intrusion detection systems, encryption, access controls, and multifactor authentication. These controls are tested periodically by external technology audit firms with penetration tests and security audits. • Policy Controls: Annually all employees sign off on the Company's data and device controls. The Company ensures that all information access points are the Company's assets and all data passing through these access points are accessible by the Company and can be deleted whenever the Company deems necessary. • Employee Training and Awareness: Ongoing cybersecurity training and awareness programs are implemented to educate employees about potential threats, phishing attacks, social engineering tactics, and best practices for safeguarding company information. • Incident Response: The Company maintains a comprehensive incident response plan to promptly detect, contain, and recover from cybersecurity incidents. Regular testing and simulation exercises ensure readiness and effectiveness of response capabilities. • Third-Party Risk Management: The Company regularly evaluates and monitors the cybersecurity posture of third-party vendors and partners with whom data is shared or relied upon for critical services, to ensure they meet the Company's security standards. • Continuous Improvement: The Company regularly reviews and makes enhancements to the cybersecurity program to adapt to emerging threats, technological advancements, and changes in regulatory requirements. Implementation of new technologies, practices, and infrastructures to target security vulnerabilities is ongoing. • Compliance and Reporting: The Company adheres to relevant cybersecurity regulations and standards applicable to our industry and maintains transparency by disclosing material cybersecurity incidents or risks in accordance with regulatory obligations. The Company had no material cybersecurity incidents in 2023.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: The Company's information security team has a defined escalation path for issues and events as outlined in our Security Incident Response Policy. Our Chief Technology Officer, along with teams from information security, IT infrastructure, IT support, and system analysts, will take the lead role in evaluating, escalating, investigating and remediating a potential cybersecurity event, including formulating the initial response and bringing in individuals from other departments as deemed appropriate. Any incident assessed as potentially being or becoming material is further escalated to the Operating Committee which includes all executive officers and may be elevated to the Board of Directors if the incident is deemed material or otherwise appropriate. Outside legal counsel and forensic analysts may also be engaged to assist in evaluating and remediating cybersecurity issues and events.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee")

companyName: Alset Inc.

ticker: AEI


text: Our cybersecurity risk management policies and procedures are informed by industry standards, and they are designed to address cybersecurity risks identified by external auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. Our team of information technology and cybersecurity professionals, led by our Chief Information Officer, or CIO, manages and maintains remediation strategies for identified cybersecurity risks and regularly reports on such risks to senior management, including our Governance Committee as described below.

companyName: WisdomTree, Inc.

ticker: WT


text: Management's Role Managing Risk The Company's IT Committee, which includes senior executives and other members of management, meets regularly to monitor and discuss cybersecurity issues. The Senior Vice President of Information Technology, the Executive Vice President and Chief Accounting Officer ("CAO") and the Executive Vice President, General Counsel and Head of M&A ("GC") play a pivotal role in informing the Board on cybersecurity risks. They provide comprehensive briefings to the Board on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board, Senior Vice President of Information Technology, CAO and GC maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.

companyName: Matador Resources Co

ticker: MTDR


text: Our Enterprise Risk Management ("ERM") process, which is governed by an ERM Committee, includes a review of our cybersecurity programs. The ERM Committee, which is led by our executive vice president and chief financial officer, meets quarterly, and receives updates from the CISO on emerging risks, recent cyber risk events, and any priority risks relating to cybersecurity. We also have a Cyber & Privacy Steering ("CPS") Committee, which meets regularly and is comprised of senior management, serving as a multi-disciplinary group for coordinating and overseeing the management of the cybersecurity and privacy programs.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly, as well as through the audit committee of the board of directors, which has been tasked with such oversight in the audit committee charter. The audit committee of our board of directors reviews our cybersecurity and information security risks and mitigation strategies. Our VP of IT/IS provides briefings to the audit committee on a quarterly or more often basis as needed regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses and remediation efforts, cybersecurity systems testing, activities of third parties, policies and the like.

companyName: Fabrinet

ticker: FN


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks is delegated to our Senior Director, Head of IT and Informatics, who reports on IT operations, risk mitigation and assessment efforts, and other general cybersecurity matters to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: Assessment of our Program We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third parties. Our IT security team monitors alerts and meets as needed to discuss threat levels, trends, and remediation.

companyName: APi Group Corp

ticker: APG


text: We maintain strategic partnerships with third-party service providers to enhance our security measures and improve resilience against cybersecurity threats. Annual penetration tests are conducted by a third party to evaluate existing security measures and identify improvements. Additionally, the Company engages a managed detection and response service to monitor our end points, identify suspicious activity, and perform actions to prevent or stop attacks.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: In the past year and with the guidance of a qualified third-party, we have made improvements in our cybersecurity program across the Company, and we have developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, we focus on our employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: CRAWFORD UNITED Corp


text: The Company recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, and violation of data privacy laws.

companyName: MOVADO GROUP INC

ticker: MOV


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks including risks associated with the Company's use of artificial intelligence. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance, and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: Our cybersecurity organization includes a response team and management-level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, we maintain an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. We generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include our Chief Financial Officer, Chief Technology and Product Officer, Executive Vice President of Enterprise Operations, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by our Board of Directors and our senior leadership team. Some of the more significant risks discussed by the ROC are also reported to our Risk and Security Committee at least quarterly.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware, software and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provides an annual cybersecurity update to each of the board of directors and the audit committee.

companyName: Sweetgreen, Inc.

ticker: SG


text: Related to Cybersecurity Risks Our Head of Information Technology ("Head of IT") is responsible for the strategic leadership and direction of the Company's information technology organization. Our current Head of IT has over thirty years of experience leading information technology teams in the life sciences industry. The Head of IT reviews threat intelligence, and receives updates from the Company's third-party providers, to help identify risks from cybersecurity threats.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: leverage the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: CRH also provides regular and focused training to aid employees in understanding and complying with relevant Company policies and applicable regulations, including those related to cybersecurity.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—Increasing dependence on information technology systems comes with specific risks, including cybersecurity breaches and data leaks, which could have an adverse effect on our business."

companyName: CULP INC

ticker: CULP


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: QVC INC

ticker: QVCD


text: The Company has a comprehensive incident response plan to address cybersecurity incidents. The Company's incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to periodic review and assessment. The Company also engages external parties, including consultants and a computer security firm to facilitate its cybersecurity oversight and assist in our response in the event of a cyber-attack or breach. Further, the Company has procured cyber-insurance that would provide coverage and consulting services in the event of a significant security breach. To date, the Company believes that its cybersecurity program has been effective in protecting the confidentiality and integrity of its information and systems; however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. In addition, the Company's cyber insurance may not be sufficient in type or amount to cover claims related to security breaches and cyber-attacks.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training sessions.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: Our information security office is supported by a team consisting of personnel with experience and expertise in cybersecurity risk management strategies, execution and operations, with domain expertise in cloud services security, infrastructure and operational technology security, cybersecurity incident response, and tactical governance risk compliance.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 18 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 11 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see " Part I, "Item 1A. Risk Factors" of this Annual Report on Form10-K.

companyName: S&T BANCORP INC

ticker: STBA


text: Our information security program is designed to detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our systems from cybersecurity threats, we use various security tools that help prevent, escalate, investigate, and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: MAGELLAN COPPER & GOLD Corp

ticker: MAGE


text: As part of its risk oversight function, our Board, including through delegation to its Audit Committee, regularly receives risk management reporting from various officers of the Company responsible for different risk disciplines, including with respect to cybersecurity and IT risk, and oversees management's administration of our cybersecurity risk management program. For example, officers within our IT department provide periodic (generally at least once per quarter) reports from management to the Audit Committee related to cybersecurity, our cybersecurity risk management program and related risks, with copies of these reports also provided to our full Board. These reports supplement materials and presentations from outside experts that are also provided to our Board members from time to time as part of the Board's and Audit Committee's continuing education on risk oversight topics such as cybersecurity that impact companies in our industry and, more generally, publicly-traded companies. In addition, management provides event-driven updates to the Audit Committee and Board regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Under our cybersecurity incident response plan, our Chief Legal Officer is responsible for escalating to the Audit Committee and Board information regarding any material cybersecurity incident.

companyName: REDWOOD TRUST INC

ticker: RWT


text: The Information Technology and Information Security sub-committee is a working group of the management level Enterprise Risk Management Committee and represented by managers within various departments and includes the CISO and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. This sub-committee meets quarterly to provide oversight of the technology management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. Meetings with key team leaders occur as required and in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Company's Executive Leadership Team meets monthly with the CISO and Deputy CISO and reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at various meetings and responses to any actions taken to/from the Enterprise Risk Committee on a quarterly basis or more frequently as may be required by the IRP.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we may also require that such providers possess at least one of the following certificates, reports, or procedures: SOC 2 Type 2; ISO 27001; annual penetration tests; and/or red/blue team tests.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: The Company's Board of Directors (Board) and its Audit Committee exercise oversight of the Company's ERM program, including the cybersecurity program. Management, led by the Director of Information Security and Compliance, provides at least three updates per year to the Audit Committee on cybersecurity topics, and the Audit Committee regularly reports to the Board on these presentations. In addition, the Director of Information Security and Compliance provides an annual cybersecurity update to the full Board. Management's updates cover relevant cybersecurity topics, both ongoing and unique in nature, including risk exposures and management's actions to monitor and mitigate such risks, emerging threats or regulations, and status updates on projects to strengthen and mature the Company's systems and cybersecurity programs. Management's escalation protocol includes reporting of certain cybersecurity threats or incidents to the Audit Committee in a prompt and timely manner.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program is led by our senior vice president of information technology who has over 25 years of information technology experience that includes application development, information technology infrastructure, security, business continuity, and engineering. He holds a master's degree in computer science and a bachelor of engineering in electrical engineering. Our vice president of cybersecurity reports to the senior vice president of information technology and has over 25 years of operations and security experience backed by an undergraduate degree in computer management and various technology and security certifications. Our vice president of cybersecurity is responsible for the day-to-day assessment and management of cybersecurity risk. Our cybersecurity risk management program includes the following key components, which allows the management team to stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents: • implementing technologies to proactively monitor vulnerabilities and reduce risk, maintaining security policies and standards, and regularly updating our response planning and protocols; • maintaining business continuity, contingency and recovery plans, including a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • retaining a third-party cybersecurity provider for emergency incident response services; • annual assessments of our cybersecurity risk management program by a third-party security firm, as well as semi-annual vulnerability assessments and penetration testing by external service providers; • cybersecurity awareness training for employees as well as senior management, including quarterly refresher training; and • annual cybersecurity assessments of certain third-party service providers with access to our employee data.

companyName: HOST HOTELS & RESORTS L.P.


text: We also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or our information technology systems. Atmos Energy currently conducts cyber assessments on potential vendors that will have access to information technology systems, data or facilities that house such systems or data. Following approval, those vendors are contractually required to manage their cybersecurity risks and provide notification in the event of a cybersecurity incident.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: Albemarle Corporation and Subsidiaries We follow a zero-trust architecture approach and enforce the use of multi-factor authentication and virtual private network technologies for all external access to provide secure support for our remote workers. Information security training is part of our compliance program, and includes mandatory security training for new hires, mandatory yearly security training for all staff, and periodic phishing tests to raise awareness and response actions.

companyName: ALBEMARLE CORP

ticker: ALB


text: The VP of Information Security is responsible for hiring appropriate personnel, performing vendor risk assessments, and communicating information security priorities to relevant personnel, so that we can build cybersecurity risk considerations into our business practices. The VP of Information Security also plans related budgets, designs cybersecurity processes, and reviews security assessments and related reports.

companyName: OptimizeRx Corp

ticker: OPRX


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives annual cybersecurity updates from senior management, and the Audit and Compliance Committee provides a deeper level of oversight through an annual review to management's approach to cybersecurity risk with the Director – Information Systems. The Board and the Audit and Compliance Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: BADGER METER INC

ticker: BMI


text: We face a number of cybersecurity risks in connection with our business. Such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date. For more information about the cybersecurity risks we face, see the risk factor entitled " Security breaches, loss of data, and other disruptions to our business or the business of our third-party service providers could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation. " in Item 1A. Risk Factors.

companyName: Axe Compute Inc.

ticker: AGPU


text: We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with material impact or reasonably likely to materially impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization.

companyName: Freedom Holding Corp.

ticker: FRHC


text: For this requirement in Item 106(c)(2), the SEC noted that this list is a "non-exclusive list" that companies should consider when describing management's role in cybersecurity oversight, and that this disclosure would "typically encompass identification of whether a registrant has a chief information security officer [(CISO)] or someone in a comparable position." The detailed information required about the CISO's background (including the CISO's prior work experience, knowledge, skills and degrees or certifications held) is notable in that it goes beyond current disclosure requirements regarding other members of company management.

companyName: Energy & Water Development Corp

ticker: EAWD


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, using widely recognized industry frameworks. We use risk management strategies that focus on vital areas such as data protection, access control, incident response, and vulnerability management, and we have integrated these processes into our overall risk management program. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Alector, Inc.

ticker: ALEC


text: The program is aligned with industry frameworks and controls from the National Institute of Standards and Technology, including NIST Cybersecurity Framework, v2.0. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain and enhance cybersecurity, including threat intelligence, penetration testing, multi-factor authentication, and endpoint detection and response. The Company maintains a cyber incident response plan, which is tested periodically. The Company maintains a cybersecurity insurance policy, which gives us access to expert forensic and legal experts to help manage a major incident or a data breach. We have rolled out a formal cybersecurity awareness training program to our entire workforce as part of our annual ethics and compliance training. Additionally, the Company conducts ongoing phishing and social engineering simulations that are tied to our cybersecurity awareness training program, and our workforce is encouraged to report any suspicious activities to our cybersecurity team. The Company also has processes in place to oversee and identify risks from cybersecurity associated with the use of third-party service providers that could impact our business. We review available data related to our third-party service providers and assess the appropriateness of our service providers' cybersecurity programs and practices to ensure risks are properly mitigated. In fiscal year 2025, we commissioned an independent assessment from an accredited firm to evaluate the effectiveness of our cybersecurity program and plan to make adjustments to address the improvement opportunities identified in the assessment. We intend to perform this assessment on a biennial basis going forward.

companyName: REV Group, Inc.


text: The cybersecurity ERM process is administered by InfoSec with input from each business segment and function, continually monitors material cybersecurity risks facing Comtech, including cybersecurity threats and threats to our internal systems, our products, services and programs for customers, and our supply chain. Our CISO has extensive experience leading information technology for global organizations across communications, aerospace and defense, and works directly with our CEO, Chief Financial Officer, Executive Vice President ("EVP") of Systems and IT Controls, and other members of senior management to assess cybersecurity threats as part of our ERM process.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council ("FFIEC") regulatory guidance, and other industry standards such as the Center for Internet Security ("CIS") and the National Institute of Standards and Technology (NIST) Cybersecurity Framework ("CSF"). In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence to facilitate and promote program effectiveness. Our Chief Information Security Officer, Chief Technology Officer, and our Chief Information Officer regularly collaborate with industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Our SVP of IT and Facilities is responsible for preparing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Audit Committee of our board of directors is responsible for oversight of our risk assessment, risk management and cybersecurity risks, and periodically updates our board of directors on such matters. Members of the Audit Committee engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB