text: The Chief Information Security Officer, who is primarily responsible for our cybersecurity strategy and assessing and managing risks from cybersecurity threats, works together with our Chief Information Officer, Chief Risk Officer and compliance organization, as well as other functions, in administering our information security program in a manner that satisfies applicable legal and regulatory requirements. The Chief Information Security Officer has over 19 years of experience in information security, technology audit, and technology operations and includes the design, implementation, and maintenance of greenfield cybersecurity programs for regulated specialty insurance and software-as-a-service companies. The Chief Information Security Officer has a master's degree in information technology with a specialization in cybersecurity augmented with numerous professional designations. The Chief Information Security Officer receives reports on potential cybersecurity threats from throughout the business on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Further, our team strives to stay current with respect to cybersecurity threats through training and investing in the relevant tools. Our Chief Information Security Officer, Chief Information Officer and Chief Risk Officer provide regular updates and reports to our senior leaders.

companyName: Enact Holdings, Inc.

ticker: ACT


text: As of December 31, 2024, we have not identified any cybersecurity threats that have materially affected our business strategy, results of operations, or financial condition. However, we recognize that future incidents could have a material adverse effect on our business, financial condition, results of operations, cash flows, or reputation.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS

secItem: Item 1C


text: Management has day-to-day responsibility for identifying risks facing FactSet, formulating risk management policies and procedures, managing our key risk exposures on a day-to-day basis and setting the right "tone at the top." As part of this, the ERM and technology teams, including the CISO, also deliver regular updates to the ELT on cybersecurity and related matters.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Information Security, Product Security, Compliance, and Legal teams.

companyName: Toughbuilt Industries, Inc


text: The Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs. The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items. In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: We believe cybersecurity is critical to advancing our technological advancements. As a clinical stage biotechnology company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: Okta devotes significant resources, including human and financial capital, to create security measures, configuration policies and response plans to address cybersecurity threats. However, as a well-known provider of identity and security solutions, Okta is a particularly attractive target for such threats. For additional information related to these risks, see " Risk Factors " included under Part I, Item 1A of this Annual Report on Form 10-K. In the past we have experienced cybersecurity incidents, and we cannot anticipate when or the extent to which cybersecurity breaches will materially affect Okta or its customers' use of Okta's platform in the future. To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that Okta's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.

companyName: Okta, Inc.

ticker: OKTA


text: Cybersecurity Risks To date, we are not aware of risks from cybersecurity threats, including as a result of any previous known cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks, and we have experienced cyber-attacks, and routinely experience cybersecurity threats and attempts to gain access to sensitive information, as do our customers, suppliers, and other third parties with which we work. We cannot provide assurance that our processes and procedures will be sufficient to anticipate, detect, recognize or prevent cybersecurity threats. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors – Risks Related to Our Operations"

companyName: Spirit AeroSystems Holdings, Inc.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: AGIOS PHARMACEUTICALS, INC.

ticker: AGIO


text: Our Board of Directors considers cybersecurity as part of its risk oversight function. While management is responsible for the day-to-day management of risk, our Board of Directors maintains oversight of management's implementation of our cybersecurity risk management processes. Our Board of Directors receives briefings on material cybersecurity incidents, as necessary.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of the Company's risk management controls, including controls in connection with risks from cybersecurity threats.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: Roper has also established a Cyber Disclosure Committee chaired by the Vice President of Cybersecurity to track and evaluate cybersecurity incidents and to assess their potential impact on the organization. This process builds upon the CSIRP and provides a framework for Roper management to monitor potentially material cyber incidents. The Cyber Disclosure Committee reports its activities and findings, as appropriate, to the Chief Executive Officer, Chief Financial Officer, Principal Accounting Officer, and General Counsel, and, if appropriate, to the Board of Directors.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Our Board oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: RYTHM, Inc.

ticker: RYM


text: We have a vendor management process to manage cybersecurity risks associated with our use of external providers that includes a risk assessment, reviews of vendor audits and reports, and we also impose certain contractual information security obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Risks from Third-Party Service Providers and Others Blackbaud also maintains a defined program and dedicated team that provides security oversight of its third-party service providers. This program assesses and manages risk at the onboarding phase of engagement with third-party vendors and partners as well as oversight throughout the lifecycle of the vendor relationship.

companyName: BLACKBAUD INC

ticker: BLKB


text: The audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Management reports cybersecurity risks to the Enterprise Risk and Compliance Committee in accordance with the risk management program and to our Board's Audit Committee in an effort to keep our Board apprised of the rapidly evolving cyber threat landscape and to enable the assessment of the effectiveness of our overall cybersecurity and compliance programs.

companyName: Toast, Inc.

ticker: TOST


text: Governance and Responsibilities The Board recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management, or ERM. The Company seeks to mitigate cybersecurity risks through a cross-functional approach, including its Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by assessing, identifying, and managing risks from cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Cleco is implementing processes to manage the cybersecurity risks associated with its use of third-party service providers. Additionally, Cleco is actively reviewing and updating all third-party service contracts upon renewal for potential amendments related to security, confidentiality, and recourse in the event of a negligent incident, such as a breach, loss, or unauthorized use of Cleco's data. These measures provide the structure for managing Cleco's cyber-related risks.

companyName: Cleco Corporate Holdings LLC


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive. Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.

companyName: US BANCORP \DE\

ticker: USB


text: Management's cybersecurity processes have been integrated into overall risk management system and processes. Management considers cybersecurity threat risks alongside other Company risks as part of its overall risk assessment process. Cybersecurity risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Governance and Risk Management Reflect Scientific maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, including the assessment of cybersecurity risks related to third-party vendors and suppliers. This program is integrated within the Company's enterprise risk management process and the results of the risk assessment, which occurs at least annually, along with mitigation strategies, are discussed with the senior management.

companyName: REFLECT SCIENTIFIC, INC.

ticker: RSCF


text: Rigorous controls are in place to mitigate risks associated with third-party service providers, including security risk assessments and contractual security requirements.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our operations, business strategy, operating results, and financial condition. For more information regarding cybersecurity risks that we face and potential related impacts on our business, see the section titled " Risk Factors " in Part I, Item 1A of this Report.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Employee awareness towards potential threats and how to steer clear of any phishing or social engineering attacks, is a critical element that governs efficacy of any cybersecurity measures. To that end, Crexendo subscribes to periodic security awareness training, and mock tests for all employees and contractors. Employees and contractors are evaluated for timely completion of the training, on corresponding quiz scores, and based on how they fare tackling mock phishing emails. Worse than minimum required scores trigger actions to guide the person towards better security awareness and thereby score. Disciplinary actions are in store for employees/contractors who still fail to secure the minimum required score.

companyName: Crexendo, Inc.

ticker: CXDO


text: Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Stride, Inc.

ticker: LRN


text: We continuously update and improve our cybersecurity program through independent assessments, penetration testing, and system vulnerability scanning. Our security framework follows a hybrid approach, incorporating best practices from the Center for Internet Security framework and incorporating relevant standards from the National Institute of Standards and Technology Cybersecurity framework. We also undergo an annual third-party assessment to evaluate the maturity of our cybersecurity program. Additionally, we periodically engage external advisors to assess our program's effectiveness, strengthen policies, and identify potential vulnerabilities. Our Security Operations Team led by VP of Technology, collaborates regularly with IT network teams and other management stakeholders to review and address cybersecurity risks and opportunities. We have a global incident response plan with defined incident management protocols, escalation timelines, and responsibilities among other policies to manage data and its risks. As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: Superior engages cybersecurity partners and consultants to help strengthen its cyber-resiliency program. These engagements include but are not limited to incident response ("IR") planning and IR retainers, penetration testing, vulnerability assessments, IR plan testing, and advisement and awareness of latest threat vectors.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: For a description of the cybersecurity risks and related impacts that may materially affect the Company and how they may do so, see our risk factors in Part I, Item 1A of this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in adverse consequences that materially affect our business, including without limitation regulatory investigations or actions, a material disruption of the development programs of our product candidates, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Engagement of Third Parties We enlist third-party cybersecurity assessors and consultants to evaluate and test both our risk management systems and the third-party risk management systems of our business partners. Through these collaborations, we tap into specialized knowledge and insights, helping us gauge the effectiveness of our cybersecurity strategies and processes. The findings from these assessments guide our decision-making and planning processes, influencing how we set priorities and allocate resources.

companyName: NERDWALLET, INC.

ticker: NRDS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee (the "Committee") since its formation in 2017 oversight of business continuity, cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: CALIX, INC

ticker: CALX


text: BorgWarner's Board of Directors acknowledges the importance of upholding the trust and confidence of BorgWarner's customers, business partners, employees and other stakeholders. The Board, in conjunction with the Audit Committee, is involved in the oversight of the Company's risk management program, including its Cybersecurity Program. The Cybersecurity Program is managed by the Chief Information Officer ("CIO"), whose information technology ("IT") team is responsible for enterprise-wide information technology, including cybersecurity strategy, policy, standards, architecture and processes. The Company benchmarks the Cybersecurity Program, including its standards, processes and practices, against recognized cybersecurity frameworks. The Cybersecurity Program continually enhances the enterprise security structure and contingency plans with the goal of preventing cybersecurity incidents to the extent feasible and minimizing the business impact should an incident occur.

companyName: BORGWARNER INC

ticker: BWA


text: Our cybersecurity risk management and strategy processes are led by our CTO, assisted by our Vice President of Infrastructure and Operations. Together, they have over 20 years of combined professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and managing multiple industry and regulatory compliance environments.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Among the risks we assess is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the DigitalBridge cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our information technology networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to ask if they were impacted and if any Company data was compromised. In addition to the foregoing, the Company's Internal Audit team assesses the design, effectiveness and tests cyber controls, and annually as part of its SOX testing, performs a review of cybersecurity audit reports for the in-scope application vendors.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Cybersecurity Program Overview Oxford Funds has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists with the oversight of other third party service providers and their cybersecurity programs. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. Oxford Funds actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: The Company's cybersecurity function is staffed with dedicated professionals who continuously monitor risks and evaluate the resiliency and effectiveness of the architecture and defenses within Spire's systems. The Company also maintains policies, procedures and standards to manage conduct within Spire and to be prepared for new cybersecurity threats and events. The cybersecurity program involves a variety of training and education to increase awareness of cybersecurity threats through mandatory annual security awareness training for all employees, quarterly phishing campaigns, and table-top exercises. The Company also engages third parties to evaluate potential risks through external penetration testing to assess the efficacy of systems.

companyName: SPIRE INC

ticker: SR


text: No known risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, our business strategy, results of our operations, or our financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For more information about these risks, please see "Risk Factors – General Risk Factors" in this annual report on Form 10-K.

companyName: AMERISAFE INC

ticker: AMSF


text: Pega Cloud for Government is rated FedRAMP Moderate and undergoes several security assessments a year as part of the FedRAMP certification process. Our Chief Technical Systems Officer reviews these assessments and provides updates to our SSG.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Board of Directors oversees risks from cybersecurity threats. Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, the Audit Committee and the Board of Directors hold discussions with management, including the CTO on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures annually and as needed during both scheduled and special meetings. If new material cybersecurity risks arise, the Board of Directors and the Audit Committee are informed through regular discussions between the CFO and both the Chairman of the Board and the Audit Committee Chair. These discussions are then brought to the attention of the Board of Directors and Audit Committee at the next meeting.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Valvoline is committed to protecting information that is valuable to customers and critical to business operations from unauthorized access and disclosure by devoting significant resources to protecting information systems and data through investing in people, technology, and processes to protect data and systems against evolving cybersecurity threats. A cybersecurity program has been designed and implemented that is believed to reasonably manage risks from cybersecurity threats and enable the Company to prevent, monitor, identify, detect, investigate, respond to, mitigate, and report on threats and incidents.

companyName: VALVOLINE INC

ticker: VVV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, ("Information Systems and Data").

companyName: EMERSON RADIO CORP

ticker: MSN


text: We appreciate the need to monitor and test our systems to make sure that they are working the way that they should. We negotiate with our vendors about a variety of monitoring, testing, and reporting provisions so that we can work with them to better address vulnerabilities. This may include sharing SOC 1 or 2 Type 2 audit reports, conducting periodic penetration and vulnerability testing and confirmation that vendors are adhering to applicable laws. We also deploy the same approach internally, and we are currently expanding our testing efforts across our servers and networks, continually monitoring access (including more formal quarterly access reviews for any systems that are subject to SOX oversight), and documenting changes via a ticketing system. In addition to tracking logins, our monitoring system is equipped to respond automatically to certain triggers, taking a range of actions, from notifying administrators to locking out an account. Some of this testing and monitoring is conducted in-house and some is conducted by third-party vendors.

companyName: Portillo's Inc.

ticker: PTLO


text: As of the date of this Annual Report, Cibus does not believe that any past cybersecurity incidents have had, or are reasonably likely to have had, a material adverse effect on the Company's business, operations, or financial condition. However, there can be no assurance that the Company's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats, and it is possible that these events may occur and could have a material adverse effect on the Company's business, operations, or financial condition. See "Risk Factors—Risks Related to Cibus' Organization and Operations—Cibus' internal computer systems, or those of its third party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of Cibus' operations." under the heading "Risk Factors" of this Form 10-K.

companyName: Cibus, Inc.

ticker: CBUS


text: Our Company places a high priority on cybersecurity, information security, and securing confidential business information and personal information that we receive and store related to our customers and employees. Our Company's Audit Committee oversees the cybersecurity risks faced by the Company. In connection therewith, a Cybersecurity Steering Committee, which consists of our Chief Financial Officer, Chief Operating Officer, General Counsel, Vice President of Software Development, and Vice President of Regulatory Affairs, was formed to identify material risks and cybersecurity threats arising in our business.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, managing, and reporting material risks from cybersecurity threats and incidents. Our information security management program generally follows processes outlined in frameworks such as the National Institute of Standards and Technology Cyber Security Framework and ISO 27001 international standard for Information Security. Due to the nature and location of the work that we perform, we are often required to obtain certifications required by our clients and regulators. We evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: TETRA TECH INC

ticker: TTEK


text: Autodesk has established policies and processes for assessing, treating, and managing material risk from cybersecurity threats based on relevant industry standards. These policies and processes are reviewed and updated at least annually. We have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may adversely affect the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Autodesk, Inc.

ticker: ADSK


text: Item 1A ("Risk Factors - Our internal computer systems, or those that are expected to be used by our clinical investigators, clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of development programs for our product candidates.") for further insights into cybersecurity attack-related risks that we may face.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: Processes to identify material risks associated with the use of third-party service providers. In addition to internal resources, we utilize third-party service providers to supplement and maintain our information technology systems. We have procedures to oversee and identify cybersecurity risks associated with our use of these third-party service providers, including procedures that apply in the event of a cybersecurity incident at a third-party service provider that results in our systems or data or our customers' data being compromised. These processes and procedures include, among others, a diligence review conducted by our information technology team of substantially all of our external business partners and a focused review of any such third parties' cybersecurity audit attestations, such as Service Organization Controls, NIST 800 alignments, ISO certifications, PCI DSS compliance or other recognized external reviews. In the case of a cybersecurity incident affecting a third party, these procedures also govern interactions with personnel of the impacted third-party to determine the date, scope and effects of the cybersecurity incident, review the response and remediation measures taken by the third-party and conduct an inventory of potentially compromised data. Our notification process for a cybersecurity incident affecting a third party is the same as the notification process that applies to a cybersecurity incident that affects our own information technology systems and applications.

companyName: VECTOR GROUP LTD


text: Alternus faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See "Item 1A. Risk Factors" for additional information regarding our organization's cybersecurity risks, which should be read together with this "Item 1C. Cybersecurity".

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas:collaboration, risk assessment, technical safeguards, incident response and recovery planning, third-party risk management, education and awareness, and governance.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risk.

companyName: ANVI GLOBAL HOLDINGS, INC.

ticker: ANVI


text: We are committed to maintaining effective governance and oversight of cybersecurity risks. Our cybersecurity strategy focuses on implementing effective and efficient mechanisms, controls, technologies, systems and other processes across our global IT networks and systems to assess, identify and manage material risks from potential unauthorized occurrences on or through our IT systems that may result in adverse effects on the confidentiality, integrity or availability of our IT systems and the data residing therein. These processes are designed to promote (i) strong controls across our entire IT ecosystem, (ii) transparency across our IT infrastructure so that our information security team can detect, identify and escalate anomalies for further analysis and action, and (iii) a sound enterprise security architecture with security integrated into each phase of system implementation. We believe that the processes and controls we have established to protect our stakeholders' interests, including with respect to our current regulated products and internal systems, are robust and aligned with applicable cybersecurity regulations and certain identified industry best practices. This includes security by design, regular penetration testing, vulnerability scanning and standardization where possible of cybersecurity architecture principles.

companyName: QuidelOrtho Corp

ticker: QDEL


text: The technologies we utilize for cybersecurity monitoring across our information technology environment are designed to prevent, detect and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Atlas Lithium Corp

ticker: ATLX


text: To manage risks associated with third-party service providers, the information security team categorizes suppliers based on factors such as volume and criticality of data handled, potential impact on business operations and level of access to our information systems. We conduct risk assessments to identify potential threats and vulnerabilities associated with each supplier. We screen suppliers to ensure they meet proper security standards and compliance requirements. We monitor all supplier activities to ensure compliance with information security policies and conduct regular reviews and audits of supplier relationships to ensure ongoing compliance. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to alert us promptly of material cybersecurity incidents by virtue of the documents governing their relationship with us or applicable law.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. The Company's CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD's Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CISO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.

companyName: Plymouth Industrial REIT, Inc.


text: Management's Role Managing Risk The Company's Enterprise Risk Management Committee (the "ERMC"), an interdepartmental, management-level committee, meets at least quarterly and is responsible for ensuring that the Company has appropriate policies and procedures in place to help identify, measure, monitor and control potentially significant business risks. In connection with these responsibilities, the ERMC receives quarterly risk and control self-assessments and action plans for risk remediation, if required, to reduce residual risks. This includes information security action plans from the CISO, the CDO, and/or other key stakeholders. The incorporation of these reports into the ERMC's meetings is intended to promote the inclusion of cybersecurity considerations in the risk management decision-making processes throughout the Company.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: With oversight from our board of directors, our advisor and our senior management have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity processes have been integrated into our overall risk management system. To protect our information systems from cybersecurity threats, our advisor uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our advisor also employs third parties to identify, prioritize, assess, mitigate and remediate information system risks; however, our advisor relies on such third parties to implement security programs commensurate with their risk, and our advisor cannot ensure in all circumstances that their efforts will be successful.

companyName: Moody National REIT II, Inc.


text: The cybersecurity risk management program is led by the Chief Information Security Officer (CISO). Our CISO has over 29 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. The CISO has held various executive level positions within Fortune 500 companies. Our CISO reports to the Chief Information Officer (CIO), who leads the Global Information Technology (IT) organization and works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.

companyName: Medtronic plc

ticker: MDT


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the operational risks section for more information. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.

companyName: NEWMARKET CORP

ticker: NEU


text: In an effort to remain vigilant against cybersecurity attacks, the Company further provides annual and ongoing training to all of its employees so that they have an understanding and appreciation of the cybersecurity environment and risks and the Company's policies to combat such risks. Such training includes annual mandatory training sessions on cybersecurity for all employees, periodic informational notices regarding emerging threats, and periodic testing to ensure employees are reporting suspicious activities and are diligent in their efforts to avoid phishing attacks and cybersecurity breaches. The CISO also conducts and participates in annual table top exercises with management, and periodically with Directors, in order to be prepared in the event of a material cybersecurity event.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: As appropriate, our CTO and Director of InfoSec report to the Board on a broad range of topics, including any significant cybersecurity risks, the status of ongoing projects, future roadmap planning, updates to the company's PPP, and other relevant updates to our InfoSec operations and stance.

companyName: Rumble Inc.

ticker: RUM


text: The materials provided to Farmer Mac's cybersecurity subcommittee and discussed in the meetings include: • updates on Farmer Mac's data security posture; • results from third-party assessments and testing; • progress towards predetermined risk-mitigation-related goals; • Farmer Mac's incident response plan; and • information about cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to those risks or incidents.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a primarily domestic presence, with our cybersecurity threat operations designed with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, software updates and patches, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Our team of cybersecurity professionals, led by our Chief Technology Officer, who has over 20 years of experience in the cybersecurity space and advanced training in the field of cybersecurity and technology, has primary responsibility for our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Our Chief Security and Trust Officer, who reports to our Executive Vice President, Operations, works collaboratively across our business to implement policies and procedures designed to protect our IT environment and our products and services from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with our incident response policies and procedures. Our Chief Security and Trust Officer has extensive cybersecurity experience and has served in various roles in information technology and information security for over 25 years.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Our Executive Vice President of Technology, who reports directly to the Chief Executive Officer and has over 16 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We may be harmed by breaches of security of information technology systems or our confidential consumer, employee, financial, or other proprietary data."

companyName: NOODLES & Co

ticker: NDLS


text: The Company's framework includes an incident management and response program that monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Chief Information Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

companyName: Value Exchange International, Inc.

ticker: VEII


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO and her team are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Dutch Bros Inc.

ticker: BROS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Director of IT and Legal Department or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: American Assets Trust, Inc.

ticker: AAT


text: We have taken critical steps to ensure the security and protection of our computer systems and networks. Our processes for assessment, identification and management of material risks from cybersecurity threats include routine monitoring of vulnerabilities, evaluations of new service providers, written policies for incident identification and management, and regular testing and assessment of our cybersecurity posture.

companyName: H2O AMERICA

ticker: HTO


text: We follow a structured framework linked to specific security standards and the procedural practices that the security team employs in supporting associated activities. Our information security team works closely with our managed security service provider to triage identified anomalies and alerts that are raised as risks and work across the company to validate the risk and act as deemed appropriate. The global security operations center ("SOC") within the CISO's organization is responsible for incident management including identification, assessment of initial threat, notification of key stakeholders, containment, remediation, and recovery. We have a cross-functional team prepared to respond in a timely manner to the incident and assess our obligations when incidents occur.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Financial Officer and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, and other contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: Our cybersecurity team, led by our Chief Technology Officer, Peter Shelus, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to continually improve.

companyName: Myseum, Inc.

ticker: MYSE


text: Our Chief Compliance & Audit Officer (CCO/CAO) possesses over 28 years of experience in Cyber Security and IT Controls across various complex organizations, including initial tenure at Boston University Medical Center, followed by roles at PricewaterhouseCoopers, Biogen, Vertex Pharmaceuticals, and currently OPKO Health for the past 7 years. The CCO/CAO has a master's degree in Computer Science with a specialization in Cyber Security from Boston University, a qualifying UK law degree from the University of Edinburgh, an MBA in Accounting, and a Master's of Finance from Northeastern University, in addition to a BA in Economics from Dartmouth College.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Thiago Santelmo. Mr. Santelmo, age 40, was appointed President, International of Restaurant Brands International in March 2024. He previously served as President, EMEA starting in February 2022 and prior to that was President of the Latin America and Caribbean region. Mr. Santelmo has been with RBI since 2013, holding strategic roles including Head of Finance & Business development, EMEA. Prior to joining RBI, he worked at McKinsey & Company.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Our board of directors has delegated oversight of our cybersecurity program to our audit committee. Our audit committee, which consists of solely independent directors, reviews our enterprise risk and cybersecurity risks on a regular basis. It also reviews steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity from our information technology team on a periodic basis. The full board of directors also periodically reviews our cybersecurity risks with management and the actions we are taking to mitigate such risks. The Chief Accounting Officer ("CAO") or their designee reports to the audit committee on a periodic basis on the status of our cybersecurity program. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: The Company faces various cybersecurity risks and threats that could potentially affect its operations, reputation, financial condition, and competitive position. These risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our data, systems, or networks; denial of service attacks; malware infections; phishing or social engineering attacks; ransomware attacks; loss or theft of devices or media containing our data; human error or negligence; natural disasters; power outages; or sabotage. Our data and systems may also be subject to cybersecurity breaches or incidents at its CROs, vendors, partners, or other third parties that we interact with or rely on.

companyName: TELIX QSAM INC.


text: We have established and continue to enhance our procedures for identifying cybersecurity risks and implementing defenses to mitigate these risks. We devote significant resources to maintaining and regularly updating our systems and processes to protect the security of our computer systems, software, networks and other technology assets against unauthorized parties attempting to access confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. Our cyber incident response plan provides procedures and controls for timely and accurate reporting of any material cybersecurity incident, and each associate is educated, trained and tested on cybersecurity to help be our first line of defense.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: The Audit Committee receives formal annual reports from IT management regarding cybersecurity risks. In addition, management would update the Audit Committee and Board, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: At 8x8, cybersecurity is integral to the enterprise-wide risk management program. The Chief Information Security Officer, or CISO holds a pivotal role in overseeing the Company's cybersecurity initiatives. The Company's Chief Information Security Officer has served in various security leadership roles, including at a Fortune 500 technology company, and is a Certified Information System Security Professional, or CISSP, and a Licensed Private Investigator, and completed Harvard University's Cybersecurity Managing Risk in 2021. He also held a United States Top Secret / Sensitive Compartmentalized Information, or TS/SCI, security clearance when he advised the White House, Pentagon, National Security Agency, Central Intelligence Agency, and Federal Bureau of Investigation on classified projects. Reporting directly to the Chief Legal Officer, who in turn reports to the CEO, the Chief Information Security Officer is empowered to lead the Executive Risk Management Committee. Through this committee, critical cybersecurity issues are monitored, addressed, and escalated as necessary.

companyName: 8X8 INC /DE/

ticker: EGHT


text: As of the date of this Annual Report on Form 10-K, we do not believe our business, operating results, or financial condition have been materially affected by cybersecurity risks, including as a result of previously identified cybersecurity incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: CISCO SYSTEMS, INC.


text: The Company's policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company's enterprise-wide risks, including risks associated with cyber and physical security, and the Company's programs and practices to monitor and mitigate these risks.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Our CIO routinely apprises our CFO regarding cyber risk management activities and provides updates and data, as needed, to our executive team to facilitate decisions regarding our cyber risk posture and related considerations regarding our enterprise risk management assessment. Our CIO and CFO provide to the Audit Committee of our Board of Trustees: quarterly updates on our cybersecurity risk management strategy and related activities; annual reviews of our cyber risk assessment; and other information as needed to facilitate the committee's oversight of our cybersecurity risk. Two members of this committee possess cybersecurity and information systems experience, which we believe brings valuable insight and perspective to our risk management strategy. Our CIO and CFO also provide an annual review of our cyber risk assessment to our full Board of Trustees.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: As of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: We also regularly engage third parties to perform assessments on the Cybersecurity Program, including an annual self-assessed risk review facilitated by an independent third party, where we evaluate various cybersecurity domains and control areas and benchmark our program against industry peers. Additionally, we conduct annual third-party penetration tests focused on our highest-risk areas globally, providing insights into potential vulnerabilities. These assessments are supplemented by red team exercises and real-world incident response simulations to continually improve our security posture.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). We separately operate an ERM program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition, and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: The Company has developed an information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on the Company's operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: LA-Z-BOY INC

ticker: LZB


text: Our cybersecurity team is led by our Senior Director who reports directly to our Chief Financial Officer and is responsible for assessing and managing cybersecurity risks. The Senior Director is a Certified Information Security Professional and a Certified Information Systems Auditor with over 20 years of experience evaluating and remediating IT risk and leads security control implementation, risk and compliance monitoring, security tool management, and incident response planning. Reporting to the Senior Director, the Director of Information Security possesses expert knowledge in threat modeling and vulnerability testing methodologies. The Director of Information Security leads efforts to build security into all IT processes and procedures to protect against risks related to data leakage, broken authentication, injection flaws, improper encryption, and attacks on other application vulnerabilities.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Role of the Board Our Board is ultimately responsible for the risk oversight of the Company, including risks from cybersecurity threats. The Board has delegated to the Audit Committee responsibility for monitoring the overall adequacy and effectiveness of the ERM Program, and the Audit Committee is specifically charged with discussing the Company's cybersecurity risk exposures and the steps management has taken to monitor and control these exposures. Our Chief Legal Officer provides reports on the ERM Program twice a year. The Board and/or the Audit Committee receives periodic reports, briefings or presentations on data protection and cybersecurity matters from senior information technology leaders, including our CDIO or CISO, as well as from our Internal Audit team. In addition to these Board and Audit Committee updates, our CIRP provides that significant developments or incidents, even if immaterial to the Company, will be reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee or Board is appropriate, enabling Audit Committee and Board oversight that is timely and responsive.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: We have also received inquiries from numerous state regulators related to the Data Incident. We are responding to these inquiries and cooperating fully with regulators. See Note 8 for further discussion.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Cyber Risk Management and Strategy We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, manufacturing equipment and processes, lab equipment, software, and our critical data including confidential, personal, proprietary, financial and sensitive data. Accordingly, we maintain certain risk assessment processes intended to identify risks from cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches.

companyName: FLEX LTD.

ticker: FLEX


text: The Audit Committee of our board of directors ("Audit Committee") is responsible for the oversight of risks from cybersecurity threats and the process by which the board is informed about such risks. Our CIO reports to the Audit Committee on a periodic basis on data protection and cybersecurity matters. In addition, the Audit Committee receives regular updates on exposures, threats and mitigation plans directly from our IT department.

companyName: Excelerate Energy, Inc.

ticker: EE


text: We regularly engage with external assessors, consultants, and auditors to ensure our cybersecurity practices are up to date and aligned with industry standards. These third parties conduct independent audits of our cybersecurity measures and validate the effectiveness of our risk management processes. We also engage specialized cybersecurity firms to perform penetration testing and vulnerability assessments.

companyName: Powerfleet, Inc.

ticker: AIOT


text: The Company also relies on threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by the Company for strategic cyber risk management, advisory and decision making.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: The audit committee of the Company's board of directors, with the assistance of the Company's Chief Executive Officer, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.

companyName: MDWerks, Inc.

ticker: MDWK


text: We take the following actions, among others, to demonstrate our commitment to maintaining the highest levels of information security, provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to identify, protect against, detect, respond to, and recover from cybersecurity incidents: • leverage encryption, data masking technology, data loss prevention technology, authentication technology, entitlement management, access control, network and application segmentation, anti-malware software, and transmission of data over private networks, among other systems and procedures designed to protect against unauthorized access to information; • conduct annual reviews with many of our clients on our cybersecurity and data security policies, practices and controls, and engage with regulators across the world, to remain apprised of cybersecurity and data security standards and best practices; • utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. We are currently evaluating our program against the newly issued NIST Framework 2.0. The NIST Framework outlines security controls and outcomes over five functions: identify, protect, detect, respond, and recover; • conduct network and endpoint monitoring, vulnerability assessments, and network penetration testing; • conduct quarterly information security management and incident training, and regular phishing email simulations for all associates to enhance awareness and responsiveness to possible threats; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures; • conduct information security reviews and due diligence on key service providers to identify, assess, mitigate, and monitor risks associated with our use of third-party software and services; and • maintain global information security policies and procedures, including an incident response and crisis management plan which include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Our Global IT and Global Security departments are led by our Executive Vice President and Chief Information Officer, Gertrude Van Horn, who joined us in January 2024. Ms. Van Horn is a globally recognized, award-winning executive with over 40 years of experience in global IT leadership, information security, crisis management, strategic planning and decision-making. Her expertise spans a diverse group of industries including financial services, chemicals, global manufacturing and retail. Prior to joining us, Ms. Van Horn served in C-level and executive IT leadership roles for NCH Corporation, IntegraColor, Haggar Clothing Company, JOANN Stores, Office Depot, Victoria's Secret, American Express, and J.P. Morgan.

companyName: Rimini Street, Inc.

ticker: RMNI


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Liberty's corporate level IT and cybersecurity functions assess, identify, and manage risks from cybersecurity threats at the corporate level, while Formula 1 and QuintEvents operate their own cybersecurity functions with oversight from Liberty.

companyName: Liberty Media Corp

ticker: FWONA


text: We have not experienced any material cybersecurity incidents that have impacted our business, results of operations or financial condition to date. See "Item 1A. Risk Factors" for a discussion of our risks related to cybersecurity.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Goldenstone Acquisition Ltd.

ticker: GDST


text: 6. Training and Awareness: We provide regular training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: The Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.

companyName: QWEST CORP

ticker: CTBB


text: Our cybersecurity risk management program and processes, as described in this section, do not encompass the information technology systems of our third-party managers. As a REIT, we are required to retain third-party managers to run all operational aspects of our hotels, and our hotel managers are dependent on information technology networks and systems that they procure and manage directly or through their own third-party service providers, to access, process, transmit and store proprietary and hotel customer information. We do not have access to these systems or to hotel customer information, and we rely on the security programs, processes and systems of our managers to protect hotel operations and customer information from cybersecurity threats.

companyName: HOST HOTELS & RESORTS L.P.


text: Longbridge's cybersecurity processes and practices are integrated into Longbridge's operational risk oversight program. In general, Longbridge also seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Longbridge collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur. Longbridge had over 400 employees as of December 31, 2024.

companyName: Ellington Financial Inc.

ticker: EFC


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. For example, some risks include our software supply chain and other third-party dependencies, vulnerabilities in our products and services, theft of our intellectual property, and attempts to compromise our infrastructure. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. These teams comprise professionals with deep cybersecurity expertise across multiple industries and are led by our Vice President of Privacy, Safety, and Security Engineering, who has 20 years of experience, including roles in technology infrastructure for two other large public companies. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Alphabet Inc.

ticker: GOOGL


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended September 30, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: As part of the Sponsor's ISSP for the Trust, the CISO will document in a risk assessment the Information Systems for the Trust, risks identified in Information Systems, and related risk mitigation processes and controls. Included in the risk assessment will be an assessment of each risk's potential impact on the operations affecting the Trust, on the security of the Trust's data, and also potential business consequences of each risk. The CISO will review and update the risk assessment at least annually. Additionally, at least annually (for external hosted applications) and following any significant change in operations (for all applications), the CISO is responsible for gathering information about the operation of previously identified risk mitigation strategies and any changes to information classification, identified risks or risk mitigation strategies. The CISO must evaluate the risk mitigation strategies for ongoing adequacy. The evaluation must be documented in a form prescribed by the CISO. If the CISO concludes that risk mitigation strategies are inadequate for an Information System containing confidential or internal information, action will be taken to either correct the inadequacy in a timely manner or discontinue use of the Information System.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: The DISO reports to the Chief Risk Officer and has expertise in cybercrime prevention, social engineering, identity theft, and fraud prevention, gained through prior roles within the organization.

companyName: NBT BANCORP INC

ticker: NBTB


text: Our cybersecurity risk management program is integrated in our overall enterprise risk management program. For example, our IT team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business.

companyName: SITIME Corp

ticker: SITM


text: We have not identified risks from known cybersecurity threats within the prior fiscal year, including as a result of any prior cybersecurity incident, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Please refer to "Item 1A, Risk Factors" in this report for additional information about certain ongoing risks related to our information technology that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and incident response policy, incident detection and response capabilities, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications for certain platforms, encryption of certain data, network security controls and data segregation for certain environments, access controls for certain systems, physical security, asset management, tracking and disposal, systems monitoring, incident response table-top exercises, vendor risk management program, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Definitive Healthcare Corp.

ticker: DH


text: As detailed elsewhere herein, we also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: O ur Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and experience, with over 15 years in the field of information security, including over seven years of experience leading information security departments within financial services and technology organizations as a cybersecurity executive, is primarily responsible for assessing and managing cybersecurity risk. The CISO oversees a team of dedicated information security professionals (the "Information Security Team") who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.

companyName: CARVANA CO.

ticker: CVNA


text: Board of Directors The Company's Board of Directors ( Board) and its Audit Committee exercise oversight of the Company's ERM program, including the cybersecurity program. Management, led by the Director of Information Security and Compliance, provides at least three updates per year to the Audit Committee on cybersecurity topics, and the Audit Committee regularly reports to the Board on these presentations. In addition, the Director of Information Security and Compliance provides an annual cybersecurity update to the full Board. Management's updates cover relevant cybersecurity topics, both ongoing and unique in nature, including risk exposures and management's actions to monitor and mitigate such risks, emerging threats or regulations, and status updates on projects to strengthen and mature the Company's systems and cybersecurity programs. Management's escalation protocol includes reporting of certain cybersecurity threats or incidents to the Audit Committee in a prompt and timely manner.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: The Company is committed to protecting its information system and data from cyber threats. As part of our ongoing efforts to enhance our cybersecurity posture, we conduct an annual review of our information technology control environment and engages third-party security experts to conduct risk and vulnerability assessments including penetration testing. We additionally utilize third party technical tools to control system access and filter, restrict and regulate content that may pose a material risk to the Company. Employees are required to use multi-factor authentication to access Company systems and undergo annual security training. Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk.

companyName: Lovesac Co

ticker: LOVE


text: The Audit Committee receives regular reports from management on our cybersecurity risk management program, including on changes to the broader cybersecurity landscape, threats from cybersecurity risks, our cybersecurity posture and related enhancements. In addition, management updates the Audit Committee and, as necessary, the full Board, regarding any material cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Gritstone bio, Inc.


text: The Executive Director and our Chief Legal Officer participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cyber risks or threats. Our Chief Legal Officer has received the National Association of Corporate Directors CERT Certificate in Cyber-Risk Oversight.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: The Company uses various techniques to identify cybersecurity risks, including but not limited to input from internal stakeholders, known and potential information security vulnerabilities identified through historical incidents and self-performed assessments, evaluations from third-party consultants, as well as external data including reported security incidents impacting other companies, and industry trends. The results of the assessment are used to drive alignment on prioritization of initiatives to enhance our security controls and measures, make recommendations to senior management, and if necessary, but at least annually, inform the Audit Committee and Board of Directors.

companyName: Karat Packaging Inc.

ticker: KRT


text: As one of the critical elements of our overall risk management, our cybersecurity program is focused on the following key areas:

companyName: VINEBROOK HOMES TRUST, INC.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experience any cyber security incident.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Incident reports and recommendations from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity. The Board conducts an annual review of the Company's cybersecurity posture and risk management strategies to identify areas for improvement and maintain alignment with the Company's overall risk management framework.

companyName: Energy Services of America CORP

ticker: ESOA


text: Ladder leverages a senior cybersecurity team (the "Cybersecurity Team") comprised of the Chief Technology Officer ("CTO"), Chief Administrative Officer and General Counsel, Chief Compliance Officer and Senior Regulatory Counsel, as well as senior representatives from Ladder's outsourced technology firm. The Cybersecurity Team maintains Ladder's cybersecurity program, which is designed to identify, detect and manage cybersecurity risks. The Cybersecurity Team monitors technology trends and developments to inform improvements and adjustments to Ladder's information technology ("IT") infrastructure and oversees the Company's various cybersecurity training initiatives.

companyName: Ladder Capital Corp

ticker: LADR


text: The Company regularly assesses and tests its cybersecurity policies, standards, processes, and practices, including, but not limited to, audits, tabletop exercises, threat modeling, and penetration and vulnerability testing. The Company regularly engages outside advisors and experts to anticipate future threats and trends and to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Cybersecurity Committee, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures."

companyName: COHEN & STEERS, INC.

ticker: CNS


text: In an effort to deter and detect cyber threats, we provide key employees with various cybersecurity trainings that cover a range of timely and relevant topics. The trainings function to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Skilled internal personnel manage and update cyber defense functions including engineering, configuration, data protection, identity and access management, security operations, and threat intelligence. Training programs continuously educate employees about cybersecurity risks and protection practices. Periodic social engineering testing assists management in identifying training needs.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Our Director of Information Security directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. Our Director of Information Security has more than 35 years of relevant IT experience, including 20 years directly managing information security, holds professional certifications including ISC(2)'s Certified Information Systems Security Professional (CISSP—issued 2006) and ISACA's Certified Information Security Manager (CISM—issued 2006), and has ongoing involvement in various professional organizations, including serving for the last 15 years on the governing body of the Gartner/Evanta Minneapolis CISO summit, and is a member of the Minnesota chapter of ISACA.

companyName: REGIS CORP

ticker: RGS


text: Managerial and Board Oversight To facilitate oversight, the Bank has established a front line committee, the Compliance Risk Assessment Committee, which is comprised of all members of senior management, the head of information security and certain other operationally significant employees. This Committee, which meets quarterly, is responsible for monitoring all key operational risks applicable to the Bank. Cyber risk assessments are routinely conducted and reported to the Audit Committee of the Board of Directors In addition, key members of senior management also meet annually with a cyber risk consultant who apprises management on emerging cyber threats and evaluates the Company's adequacy of cyber risk insurance coverage. The findings of this meeting are also reported to the Executive Committee. All significant matters are reported by the Executive Committee to the full Board of Directors.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors."

companyName: DOCUSIGN, INC.

ticker: DOCU