text: We maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures. Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors – Risks Related to Cybersecurity and Technology" for further information about these risks.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our cybersecurity program is managed by the Cyber Incident Response Team (the "CIRT"), which is led by the Global IT Director, System Infrastructure Manager and the Network Infrastructure Manager, each with over 20 years of experience in IT. The CIRT serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The CIRT is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The CIRT classifies detected cyber incidents to allow prioritization, response and escalation. Incidents are documented for internal reporting processes and regularly shared with senior management.

companyName: Ecovyst Inc.

ticker: ECVT

secItem: Item 1C


text: We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have a trained group of people to carry out the activities of monitoring and detection of cybersecurity threats and respond to any cybersecurity threats or incidents. The Head of IT department is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners. The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.

companyName: LINGERIE FIGHTING CHAMPIONSHIPS, INC.

ticker: BOTY


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks.

companyName: Prairie Operating Co.

ticker: PROP


text: Cybersecurity risks and threats are managed by a dedicated team within the Information Technology ("IT") Department, as well as a Security Operations Center ("SOC") managed by a third-party provider, under the leadership of the Chief Information Officer ("CIO"). This team collaborates with various departments across the Company, including legal, compliance, and human resources, to ensure a comprehensive approach to cybersecurity.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: The Audit Committee receives periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Management and Strategy we are in our early stages of our business plan, we regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity processes and practices, which are integrated into our overall risk management system. As we progress with the development of our business plans, we plan to use various security tools designed to help us identify, investigate, resolve and recover from security incidents in a timely manner.

companyName: CalEthos, Inc.

ticker: GEDC


text: Century recognizes the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Board is actively involved in oversight of Century's risk management program, and cybersecurity represents an important component of Century's overall approach to enterprise risk management ("ERM"). Century's cybersecurity policies, standards, processes and practices are based on recognized security frameworks and applicable industry standards. In general, Century seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Century generates, collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Data Classification and Protection – Littelfuse has implemented data loss prevention and classification labels and encryption on its internal unstructured data to prevent unauthorized data loss and data sharing. Structured data in ERP systems and core business systems are encrypted and protected by industry cybersecurity standards and procedures.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: In the normal course of business, we collect and store sensitive information, including proprietary and confidential business information, intellectual property, information regarding clinical and non-clinical trials, sensitive third -party information and employee information.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: Airship leverages a combination of the NIST Cyber Security Framework alongside the CMMC framework to protect its assets and secure our supply chain for our customers. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: DIH HOLDING US, INC.


text: As part of this effort, we also intend to implement controls to assess and manage risks associated with third-party service providers who may have access to our systems or data. This may include review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring.

companyName: Natics Corp.

ticker: NTCS


text: If a cyber incident is identified, the Company will conduct an objective analysis of both quantitative and qualitative factors to determine if the cyber incident is material. An incident is considered material if there's a substantial likelihood that a reasonable Interestholder would consider it important. If a cyber incident is identified, the Company will assess materiality on a timely basis.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: Our cybersecurity strategy prioritizes detection, analysis, and response to known, anticipated or unexpected cybersecurity threats; effective management of cybersecurity risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, team member training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, vendors, and other third parties, our information systems and our business operations. Multi-factor authentication and principles of "Zero Trust" are integral to our control environment. We have adopted security-control principles based on the Payment Card Industry Data Security Standard and the CIS Critical Security Controls Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable. We leverage industry associations, third-party benchmarking, results from internal and third-party audits, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and plans.

companyName: HIBBETT INC


text: Each Business Group's Chief Information Security Officer ("CISO") on at least an annual basis is to provide a report to the Business Group's senior management, regarding the state of their cybersecurity program and its material cyber risks. These reports are also shared with Berkshire's internal audit group to inform and enhance the overall company's risk management processes. In addition, each Business Group is required to maintain an incident reporting process to report significant cybersecurity events to Berkshire. Berkshire and its Business Groups engage and partner with a wide range of third parties to assess, audit, educate, implement, operate, protect, and remediate various cybersecurity related elements.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: NEE's Board of Directors is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity reports from NEE's vice president and chief information officer and its vice president cybersecurity. The cybersecurity reports to the Board of Directors include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, including cyber defenses, notable incidents and a summary of the annual cyber drill results. Significant active cybersecurity incidents and threats are communicated to the Board of Directors as they occur.

companyName: FLORIDA POWER & LIGHT CO


text: We have a risk management process and strategy in place for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management framework is closely aligned with the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework ("CSF") and is incorporated into our enterprise risk management process, information systems, vendor engagement process and employee training programs. We focus on people, processes and technology to build a defensive posture against cybersecurity threats that minimizes disruption to our business while maximizing the security and resiliency of the organization.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "—Item 1A. Risk Factors — Cyber Security and Operational Risk" in this Annual Report on Form 10-K.

companyName: Blackstone Infrastructure Strategies L.P.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. We may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. Risk factors for a discussion of cybersecurity risks.

companyName: Designer Brands Inc.

ticker: DBI


text: deployment of updates and patches as they become available from our software suppliers and consultants and maintaining the current versions of major software to reduce the exposure to vulnerabilities; the use of third-party services to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks;

companyName: MedWellAI, Inc.

ticker: MWAI


text: The Company conducts internal risk assessments, with the assistance of independent third parties, against standards including the National Institute of Standards and Technology Cybersecurity Framework. The assessment results are used to develop responsive cybersecurity controls and risk mitigation strategies. The Company's cybersecurity risk management program provides the structure for managing the respective risks through the use of a combination of automated tools, technologies and third-party monitoring, as well as ongoing employee education via cybersecurity training and security awareness communications.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: In an effort to mitigate risks related to cybersecurity threats, the Company has also designed and implemented required training for all employees, including training on the Company's security and privacy policies, which are mandatory as part of the onboarding process, with refresher trainings required annually thereafter. Additionally, the Company conducts regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: Responsibilities of Management Our corporate security team consists of the Manager of Security Engineering, a Senior Security Engineer, a Senior SRE and a Security Engineering Contractor. The corporate security team is primarily responsible for assessing and managing material risks from cyber security threats, defining and overseeing our corporate security program, reviewing technical designs and vendors for security risks, and managing our security tools and infrastructure. Our corporate security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment, including those described in "Risk Management and Strategy." The corporate security team reports to the Senior Manager of Information Technology, who reports to the Senior Director of Engineering Operations which maintains responsibility for our cyber security program.

companyName: Life360, Inc.

ticker: LIF


text: To evaluate cybersecurity and privacy incidents and enable us to comply with public disclosure requirements, we have a Privacy and Security Incident Response and Reporting Policy and Procedure (the "Policy") with defined escalation criteria (the "Plan") in support of our incident response processes. The Plan provides a framework to our Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer ("CPO"), CISO and applicable legal counsel and business and corporate services leaders, for responding to cybersecurity incidents. The Policy, together with the Plan, identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation based on facts and circumstances of each incident, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, including to our chief legal officer and CEO, a subcommittee of our SEC disclosure committee, and ultimately, our Board of Directors and appropriate Board committees. The Policy also addresses requirements for our external reporting obligations. The Policy is reviewed and updated, as necessary, under the leadership of our CISO and CPO.

companyName: Elevance Health, Inc.

ticker: ELV


text: The Audit Committee of our Board of Directors provides oversight over our cybersecurity risk management and strategy. The committee receives updates from our information technology management and external advisors on our cybersecurity posture, initiatives, and incidents on an annual or as needed basis. Our information technology department is responsible for assessing and managing our cybersecurity risks on a day-to-day basis and their processes for managing cybersecurity risks include implementing and maintaining security controls, policies, and procedures to protect our information systems and the information residing therein. They also provide periodic awareness notifications to our employees and contractors on cybersecurity best practices and their roles and responsibilities. In addition, we have established an incident response plan to coordinate our response to and recovery from any cybersecurity incidents. Our Director of Information Technology has over 20 years of experience in managing organizations in the energy and telecom industries. We also have a Certified Information Systems Security Professional, who has eight years of experience in cyber and information security.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: Our Board of Directors has overall oversight responsibility with respect to our approach to risk management, including risks relating to cybersecurity. Although the Board of Directors has the ultimate responsibility for risk oversight, our management team, including our President and CEO, has operational responsibility for cybersecurity matters, including the day-to-day management of our cybersecurity risks, and oversees processes for the prevention, detection, mitigation and remediation of any cybersecurity incidents. While our management team does not have cybersecurity expertise, we coordinate with expert consultants to assess and manage risks. Our Board of Directors reviews cybersecurity threats and risk controls at quarterly meetings based on information provided by management and outside consultants.

companyName: IMMUCELL CORP /DE/

ticker: ICCC


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are overseen by our Vice President and Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Director of Information Security, a direct report to the Vice President and Chief Information Officer. Our Vice President and Chief Information Officer has 27 years of technology leadership experience and a Doctor of Business Administration. Our Director of Information Security has 27 years of experience in infrastructure and security operations and a degree in Information Technology Management. Our Director of Information Security is the chair of the Company's Information Security Committee. The activities of the Information Security Committee are reviewed by the Executive Information Security Oversight Committee, which is comprised of members of our senior leadership team including our Vice President and Chief Information Officer, Senior Vice President, Chief Financial Officer, Senior Vice President, Chief Legal Officer and Secretary and Senior Vice President, Chief Human Resources Officer. The Executive Information Security Oversight Committee facilitates notification to the Audit Committee of emerging cybersecurity risks, and threats, the status of projects to strengthen the Company's information security systems, and updates on any cybersecurity incidents.

companyName: TREX CO INC

ticker: TREX


text: Measuring Cybersecurity Risks In order to evaluate whether a cybersecurity risk is material to Tyler, we take a multi-disciplinary approach to assessing qualitative and quantitative factors. The cross-functional team includes senior leadership from Tyler's information security, legal, finance, and accounting teams, as well as senior leadership from the impacted business unit(s).

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program aligns with Wolfspeed's Enterprise Risk Management ("ERM") program and addresses information technology and business environments. Our cyber risk management program is designed based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and we aim to incorporate industry best practices throughout.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: We regularly monitor for, defend against, and respond to cybersecurity threats to our networks and information systems, as well as other types of security threats and incidents. Despite our information security efforts, our facilities, systems, servers, platforms and data, as well as those of our third-party cloud and other service providers and Tablo's two-way wireless communication system, may be vulnerable to privacy and information security incidents and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. These include data breaches, viruses or other malicious code, exploitation of known or unknown vulnerabilities, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, insider threats or other security or IT incidents caused by threat actors, technological vulnerabilities, or human error. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information to gain access to the data and personal information we maintain. As of the date of this Annual Report, we are not aware of any material adverse impact to our business or operations from cybersecurity threats or incidents. We do, however, recognize that the cybersecurity landscape evolves rapidly and that we are not immune to such incidents. If we, or any of our third-party service providers, fail to comply with laws requiring the protection of sensitive personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, or if our incident response, containment or mitigation measures are inadequate in the face of a particular data breach or cybersecurity incident, we may face significant business interruptions, incur reputational damage, and be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, and mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. If we are unable to prevent or mitigate the impact of such security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.

companyName: Outset Medical, Inc.

ticker: OM


text: Management Oversight Our CIO, CISO and other senior executives who oversee the Company's enterprise IT infrastructure periodically meet in management committees to ensure that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The CIO, CISO and our management committees periodically provide cybersecurity reports about our Cybersecurity Program to senior management, the board of directors and our board committees.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Our CISO is responsible for implementing the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Engineering & Operations, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. Our CISO has more than 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing, including collectively serving as a chief information security officer for seven years at two publicly traded companies. Our CISO also holds an Executive Master in Cybersecurity degree, a Master of Computer Science degree, and undergraduate degrees in both computer science and mathematics.

companyName: Marathon Petroleum Corp

ticker: MPC


text: As of December 31, 2023, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Privacy and Cybersecurity Risks."

companyName: KLDiscovery Inc.


text: We maintain a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0, as well as other standards. We utilize policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity management, security information and event management systems and insider threat management systems. We also carry insurance that provides protection against certain potential losses arising from a cybersecurity incident.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Our IT Steering Committee, comprised of our Chief Executive Officer, our Chief Financial Officer, our General Counsel, and an IT consultant, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over our third-party IT consultants, monitoring systems and employee engagement. Our senior management team is responsible for reporting any identified cybersecurity risks to the Audit Committee of our Board of Directors.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: The Audit Committee oversees the cybersecurity program and receives reports from management regarding the Company's cybersecurity policies and procedures on an annual basis. The Audit Committee also receives reports from management on any cybersecurity incidents that may occur.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: We have established incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and board of directors on our response to a cybersecurity incident. We also have relationships with third party experts that can be utilized in the case of an incident.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our board of directors has delegated oversight of risk assessment and risk management activities, including oversight over cybersecurity risks, to the audit committee. The audit committee meets at least quarterly with our Vice President and Chief Information Security Officer ("CISO"), who oversees our overall information security risk management program. The CISO's updates to the audit committee include recent developments related to the threat landscape, current IT-related risks, and corresponding controls or projects designed to mitigate those risks.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which helps inform the appropriate level of additional due diligence and ongoing compliance monitoring. The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy and Information Security teams.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external and internal control validations to assess our processes and procedures and the threat landscape, and we maintain a vulnerability management program designed to identify vulnerabilities and coordinate remediation efforts for any identified vulnerabilities in the environment. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, and vendors. Results of these ongoing activities are reported quarterly to management through the Cyber and Information Technology Steering Committee. In addition, we periodically perform simulations and tabletop exercises at the management level and incorporate external resources and advisors as needed. All employees are required to complete information security training at least once every year, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: SouthState Bank Corp

ticker: SSB


text: The cybersecurity processes are designed to help oversee, identify and mitigate risks associated with Morgan Stanley's use of third-party vendors. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors. Prior to engaging third-party vendors to provide services, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity programs to identify the impact of their services on the cybersecurity risks to Morgan Stanley. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or an audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk, are subject to review, challenge and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.

companyName: Ceres Tactical Commodity L.P.


text: Management's Role Managing Risk Our CISO plays a pivotal role in informing the Risk Committee on cybersecurity risks and developments. Our CISO provides comprehensive briefings to the Risk Committee on a regular basis, with a minimum frequency of four times per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events;

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The Program is led by our CISO, who reports directly to the Chief Risk Officer. Additionally, the CISO meets regularly and works in tandem with the Chief Information Officer and various members of Information Technology. The Information Security Department meets regularly with employees through hosted educational sessions, all-employee call presentations, Officers' meeting presentations and individual branch network visits. Line of business leaders regularly reach out to the CISO with regards to cybersecurity risk prevention, questions, and training. The CISO has a standing agenda item for the Information Technology Steering Committee meeting as well as ERC in order to inform the committees about prevention, detection, mitigation and remediation of cybersecurity incidents. If there are any incidents that require information to be presented to the Executive Management Team or the Board, the Chief Risk Officer presents that information.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Our Board of Directors has the overall oversight responsibility for our risk management, and delegates the cybersecurity and other risks relating to our information controls and security to our Audit Committee. Both the Audit Committee and the full Board regularly receive updates from our management on cybersecurity matters and our ongoing risk management efforts, and actively participate in ongoing discussions. In addition, the Board and the Compensation Committee review and approve the key performance indicators applicable to all management personnel responsible for effectively managing cybersecurity risk management programs at UCT, and engage in regular review of the Company's performance against those indicators.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: We engage external parties, including consultants, network security firms and other experts, to help us assess and enhance our cybersecurity oversight. For example, we have hired an external security vendor to conduct penetration and vulnerability testing on our networks and receive regular updates about cybersecurity risks in the industry.

companyName: KADANT INC

ticker: KAI


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Implement third party cybersecurity testing (including penetration testing) of any new product feature developed prior to release; Maintain firewall and virus protection software; and Maintain a cybersecurity insurance policy.

companyName: Corvex, Inc.

ticker: MOVE


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: As of the date of this report, the company has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the company including its business strategy, results of operations, or financial condition.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity processes, which are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), are supported by a third-party Managed Service Provider ("MSP") that assists us in managing our information technology systems.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: We conduct mandatory security training during new employee onboarding, as well as require our employees to complete annual security risk training and, when necessary, perform additional updated training. We also engage certain third-parties in assessing, identifying and managing cyber-security risks. These third parties perform a number of services, including managed detection and response services for information technology endpoints, anti-virus monitoring, penetration testing, and other miscellaneous cyber security programs and services. We maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under our third-party assessment process, we gather information from certain third parties who contract with us and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.

companyName: W&T OFFSHORE INC

ticker: WTI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework).

companyName: Plymouth Industrial REIT, Inc.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management based on predefined criteria, including, for example, to our Vice President of Information Technology, Security, and Compliance, General Counsel, and CTO. Senior managers work with the Company's incident response team to help the Company mitigate and remediate certain cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board of Directors, regulators, and law enforcement for certain cybersecurity incidents.

companyName: Sprout Social, Inc.

ticker: SPT


text: We require our employees to take cybersecurity-related training regularly to promote awareness of how to detect, report, and respond to cybersecurity threats. Employees with certain roles and responsibilities are also assigned cyber training for their specific functions. We also maintain an Insider Threat program, headed by our Director of Security, to identify, assess, and deal with potential risks from within our company, including cybersecurity risks.

companyName: AeroVironment Inc

ticker: AVAV


text: The ERMC is responsible for overall risk governance and management across Tompkins. As such, the ERMC reviews cyber risk exceptions, emerging risks, minutes from the TISC meetings, and reports on the health and risk associated with the Program. The ERMC is comprised of senior leadership team members as well as critical subject matter experts with risk management experience. The ERMC reports information about risk to the Audit and Risk Committee on a quarterly basis. The ERMC is chaired by the Director of Enterprise Risk Management and the Chief Risk Officer, who oversees the governance of enterprise-wide Risk Management program(s).

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: To ensure the Company is addressing constant changes in the threat landscape, management and the Board of Directors continue to advance their cybersecurity knowledge and stay current with evolving information, regulations and industry practices through our memberships and affiliations with industry leading companies such as Crowdstrike, IBM, and Palo Alto Networks, as well as national organizations such as the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and others. In addition, to supplement our efforts, expert consultants and third-party vendors are engaged from time to time to assess enterprise security posture, identify operational technology vulnerabilities, and assess software product security. In addition to these assessments, the Company engages third-party vendors to perform enterprise-wide attack and penetration tests. Findings from these activities are reported to senior management and the Belden Board of Directors.

companyName: BELDEN INC.

ticker: BDC


text: We monitor and reassess our third-party relationships on an ongoing basis depending on risk level or in the event of a change of products and services provided to us. We also require third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment to be able to enter into a contract with us. The third-party risk assessments, conducted by our information security and enterprise risk management teams with input from key business stakeholders, involve understanding the products and services we obtain from the third party, what sensitive company and client data it will be able to access and an evaluation of the vendor's security program and documentation. We also require that certain information security-related contract terms be incorporated into agreements with third parties that will have access to sensitive information before entering into such agreements.

companyName: Paylocity Holding Corp


text: In addition, we have established a Cybersecurity Steering Committee comprised of members of executive leadership. The Steering Committee, in which our CIO and CISO participate, meets regularly and has established Company-wide policies and standards concerning cybersecurity matters. These policies cover areas such as malware protection, remote access, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. We have an established incident response plan led by our CIO and CISO and depending on the nature and severity of the incident, requires escalating notifications up to our CEO and Board.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Third-Party Risks Our Program is designed to decrease the likelihood of an impact to Customers' operations, reputation, or revenue due to a third-party or fourth-party vendor, supplier, service provider or partner of Customers ("Third-Party") issue, vulnerability, or compromise. The Program achieves this mission through a mix of monitoring, information gathering, and analysis of Third-Party quality and security at the contracting, pre-production and post-implementation stages.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Role of Management Dow's Information Systems organization is led by Dow's Chief Information and Digital Officer, who reports to Dow's Chief Operating Officer, and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation, with oversight by the Dow Inc. Audit Committee.

companyName: UNION CARBIDE CORP /NEW/


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer and/or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: TILLY'S, INC.

ticker: TLYS


text: The Company's business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations, at least annually or whenever there are material changes to our systems or operations. As part of the risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG has informed us that it uses NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that TPG, its affiliates or we meet any particular technical standards, specifications, or requirements. TPG stores data, including the Company's data, in cloud environments with security that we believe is appropriate for the data involved and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our internal financial auditor and outside counsel.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program, and specifically, reviews and oversees the Company's risk management and strategy relating to cybersecurity, including cybersecurity developments and threats and the Company's process for assessing, managing, and mitigating material cybersecurity risks and threats. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.

companyName: Alcoa Corp

ticker: AA


text: In addition, much of the sensitive information relating to hotel guests are controlled by the respective franchisor companies, affiliates of Marriott International, Inc., Hilton Worldwide Holdings, Inc., and Hyatt Hotels Corporation, each of which is a public company with enhanced cybersecurity protection policies in place which each publicly discloses.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Our processes also address cybersecurity risks associated with our use of third-party service providers used in different capacities to provide or operate some of our cybersecurity and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments and external monitoring sources, including performing dark web analyses, to better inform us during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place that are designed to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups, including the legal and finance functions, the Board, and external breach counsel, and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans for certain critical applications and services to prepare for and respond to the potential for a disruption in the technology we rely on.

companyName: Torrid Holdings Inc.

ticker: CURV


text: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Principal Engineer – Product Cybersecurity, who has more than 35 years of embedded electronic systems design experience. The Principal Engineer – Product Cybersecurity works directly with the Chief Technical Officer. These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks. Through these updates, the SET Committee receives a report discussing product level vulnerability management, product level incident management and the status of relevant product cybersecurity activities.

companyName: CUMMINS INC

ticker: CMI


text: In the last three years, we have not experienced a material information security breach incident or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.

companyName: TELOS CORP

ticker: TLS


text: The Company has processes in place to assess the effectiveness of its information technology security program. The Company applies cybersecurity assessment tools that analyze the Company's ability to identify, protect from, detect, respond to and recover from cybersecurity threats and that analyze the various controls put into place by the Company's information security program. The Company also conducts an annual cybersecurity assessment to identify risks and issues and may conduct more frequent assessments as required by a material change to the Company's cybersecurity risk. Further, the Company engages third parties to conduct penetration tests to assess the performance of the information technology security program. The results of these assessments and tests are reviewed by the Company's enterprise security team and senior management and are used to identify areas of vulnerability, which the Company then works to address.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Our written Cybersecurity Incident Response Program coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to prepare for, assess severity of, escalate information about, contain, eradicate, and recover from the incident, as well as to conduct post-incident activities, including reporting and conducting root cause analysis and remediation activities. Our incident response policies and the cybersecurity posture are subject to annual testing to evaluate our adherence to policies and compliance requirements. Policies and practices are reviewed periodically to improve processes and practice. We carry cybersecurity insurance to provide a level of financial protection should a covered incident occur.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: The CISO reports to the Chief Accounting Officer ("CAO"), who provides the Committee with bi-annual updates about our cybersecurity program and material risks.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: The Nominating and Corporate Governance Committee (the "N&CG Committee") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the N&CG Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISSO or IT manager, including updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.

companyName: DORIAN LPG LTD.

ticker: LPG


text: o Communication Strategy: Management and the Board have a communication strategy for addressing cybersecurity disclosures with stakeholders, including customers, employees, and the public.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: The Company's cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect the Company's information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned or managed by the Company. The Company places special weight on protecting sensitive information, such as personal information of the Company's customers and employees, and confidential business information that could be leveraged by a competitor or a malicious actor.

companyName: ENVIRI Corp

ticker: NVRI


text: In addition, cybersecurity is incorporated into our third-party risk management program. We assess the ability of our vendors as appropriate to adequately protect information, which includes requiring agreements that address cybersecurity. We periodically review and assess vendors' adherence to these agreements and review for information security (including cybersecurity) incidents experienced by our third-party vendors. With respect to our independent sales agents, we require each agent to execute an agent agreement containing terms governing the ownership, use and confidentiality of policyholder and proprietary information. We also engage with agency offices to support their use of measures and safeguards to protect information.

companyName: GLOBE LIFE INC.

ticker: GL


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"). We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.

companyName: PRUCO LIFE INSURANCE CO


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee. The Company's IT department regularly uses specialist firms to independently test our cybersecurity controls. The IT management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with security personnel, threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: TSS, Inc.

ticker: TSSI


text: We have established a committee specifically dedicated to determining the materiality of cybersecurity incidents (the "Materiality Determination Committee"), which includes key members of our organization: the CFO, Chief Information Security Officer ("CISO"), and the Sr. VP of Operations, the latter having ultimate oversight responsibility for compliance matters. Once a threat event is determined to have any impact, the committee is assembled, informed and the threat event's material impact is determined. If materiality is confirmed, then the reporting process starts in accordance with SEC rules (including reporting no later than four days after the materiality determination).

companyName: Satellogic Inc.

ticker: SATL


text: Our Chief Information Security Officer ("CISO"), who has been a chief information security officer at Ormat for six years, is certified by the International Information System Security Certification Consortium as an Information Systems Security Management Professional ("ISSMP"), as an Information Systems Security Architecture Professional ("ISSAP"), and as a Certified Information Systems Security Professional ("CISSP"). Our CISO oversees compliance of our information security ("IS") standards and mitigation of IS risks. We also have the following internal bodies to support our processes to assess and manage cybersecurity risk as follows:

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data; actively monitoring and mitigating cybersecurity threats and risks with a defense structure to provide oversight, governance, challenge, and testing;

companyName: Bancorp 34, Inc.

ticker: BCTF


text: We conduct vendor security assessments for key service providers including as part of our vendor onboarding process and as part of our contract review process. The cybersecurity assessment process includes considerations from an industry leading third-party vendor security ratings company.

companyName: HERBALIFE LTD.

ticker: HLF


text: Our Chief Technology Officer, or CTO, and our Chief Information Security Officer, or CISO, together with our Enterprise Risk Management Committee help identify, assess, and manage the Company's cybersecurity threats and risks. Working with a cross-functional team, these individuals and our Enterprise Risk Management Committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, using external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.

companyName: Tempus AI, Inc.

ticker: TEM


text: Our team leverages over 25 years of experience in various cyber security functions. Our CTO, and their team, are responsible for the day-to-day management of the cybersecurity program.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Previous cybersecurity incidents have not materially affected the Company. For a discussion of risks to the Company related to cybersecurity threats, see "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity", which is incorporated herein by reference.

companyName: Primerica, Inc.

ticker: PRI


text: We have established a cybersecurity supply chain risk management program, which is a cross-functional program that forms part of our ERM program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact select suppliers and third-party vendors with whom we share personal identifying and confidential information. This cyber risk assessment is performed for applicable third-party vendors during the vendor onboarding process and the results are factored into our risk-based vendor selection decision. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the products or services we procure from such suppliers. We generally require that our suppliers adopt and maintain security-control principles based on industry-recognized standards.

companyName: HIBBETT INC


text: The Corporation is exposed to a variety of cybersecurity risks that could adversely affect our operations, reputation, and financial results. Cybersecurity incidents, including data breaches, denial of service attacks, malware, ransomware, phishing, and other intrusions, could compromise the confidentiality, integrity, or availability of sensitive information and disrupt our systems. Such incidents could result in unauthorized access to customer or employee information, financial losses, regulatory penalties, and litigation. Our dependence on technology to deliver banking services and manage our operations increases the potential impact of cybersecurity risks.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: The Company leverages third-party expertise for periodic effectiveness testing of its prevention, detection, and response capabilities. The Company also requires all third-party service providers to meet certain cybersecurity requirements, including risk assessment and monitoring activities. In addition, third-party service providers with access to the Company's network are also required to undertake cybersecurity training.

companyName: Garrett Motion Inc.

ticker: GTX


text: Cybersecurity risk management and strategy are integrated into our overall risk management processes. The program monitors the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of IT presents updates on IT projects, including cybersecurity policies and programs, to executive management at least quarterly.

companyName: STAR GROUP, L.P.

ticker: SGU


text: The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology. Our corporate information technology environment aligns with the Center for Internet Security ("CIS") Critical Security Controls ("CSC"). Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology ("NIST") (NIST Special Publication 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO"), and the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015). Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems, and respond to cybersecurity incidents.

companyName: CONDUENT Inc

ticker: CNDT


text: Risks from Cybersecurity Threats To date we have not experienced any cybersecurity incidents, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our business, including our business strategy, results of operations or financial condition.

companyName: Redfin Corp


text: The Company implemented commercially available defenses against cybersecurity threats when it began relying on the internet 30 years ago. The Company does not have formal processes for identifying cybersecurity risks associated with third-party service providers. A successful attack on the Company could result in a delay in required filings with the SEC and in financial losses from attacks on bank accounts. The board of directors relies on the Company's president to identify material risks and to implement reasonable defenses. The president informs the board about such risks. The president receives direct and immediate notification of cybersecurity incidents and personally monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The president does not have formal training in cybersecurity.

companyName: ALTEX INDUSTRIES INC

ticker: ALTX


text: Although we have not experienced any material cybersecurity incidents since becoming a stand-alone public company in July 2021, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, including the Cyber Incident, have affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled "Cyberattacks, including the Cyber Incident, and other security incidents have resulted, and in the future may result, in compromises or breaches of our, our MSP partners', or their SME customers' systems, the insertion of malicious code, malware, ransomware or other vulnerabilities into our, our MSP partners', or their SME customers' systems, the exploitation of vulnerabilities in our, our MSP partners', or their SME customers' environments, the theft or misappropriation of our, our MSP partners', or their SME customers' proprietary and confidential information, and interference with our, our MSP partners', or their SME customers' operations, exposure to legal and other liabilities, higher MSP partner and employee attrition and the loss of key personnel, negative impacts to our sales, renewals and upgrades and reputational harm and other serious negative consequences, any or all of which could materially harm our business" and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, MSP partner and employee relations, results of operations, financial condition or cash flows" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: N-able, Inc.

ticker: NABL


text: The Company's information security program is managed by a dedicated Vice President (VP) of Security Compliance and Risk Management (VP of Security), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, and who reports directly to the Chief Information Officer (CIO).

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Both the CRO and ISO provide routine reports to various management committees and at the Board level—namely the ACR Committee and the Board of Directors—regarding the overall status of the Information Security Program. Such reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates to enhance the Board of Directors' ability to oversee these critical areas.

companyName: First Financial Northwest, Inc.


text: Our cybersecurity risk processes address risks associated with our use of third-party service providers, including those in our "supply chain" (subservice organizations). Third-party risks are included within our GRC and procurement program, including the selection and oversight of our third-party service providers.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: The Risk Committee of the Board of Directors is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer provides quarterly reports to the Risk Committee of the Board of Directors regarding the information security program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The Risk Committee of the Board of Directors reviews and approves our information security policies and strategies. The Risk Committee of the Board of Directors provides a report of their activities to the full Board of Directors at each board meeting.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Korn Ferry has invested in a spectrum of security tools and capabilities designed to prevent compromise of our systems and data. These solutions are selected from well recognized industry leaders and encompass a wide range of security capabilities including, among other things, threat detection, prevention, system monitoring, logging, vulnerability assessment, incident and event management, system and cloud configuration and permission management. To validate the effectiveness of our security capabilities and our supporting environment we assess them across multiple dimensions. This includes the use of independent external third-party security firms to conduct external and internal penetration tests, vulnerability assessments, and audits.

companyName: KORN FERRY

ticker: KFY


text: The board of directors, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with management.

companyName: Passage BIO, Inc.

ticker: PASG


text: In order to manage identified cybersecurity risks, we evaluate a range of remediation options and determine the appropriate course of action for effective monitoring, mitigation and treatment. Areas that have a higher level of likelihood and potentially higher level of impact are prioritized. Periodic monitoring, self-assessment and reporting to the Audit Committee are performed by senior management to evaluate, among other things, the effectiveness of mitigation strategies in minimizing or managing identified risks. In addition to critical risk management, we conduct regular exercises and simulations to review and continuously improve our incident response protocols, we work to upgrade our existing technology systems to enhance our overall security posture and we provide ongoing employee training around cyber risks. For example, employees are required to complete cybersecurity training and receive ongoing education which includes simulated phishing attacks and communications for recognizing evolving threats.

companyName: Frontier Communications Parent, Inc.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. The CISO works closely with the CIO, Chief Privacy Officer ("CPO"), and other members of the legal team who report to the General Counsel to review the cybersecurity program while monitoring global data protection regulations and cyber security laws. The CISO, CIO, and CPO, collectively, have over 35 years of work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our CISO is currently a board member for the National Technology Security Coalition, a non-profit, non-partisan trade association serving as the voice of CISOs to help improve national cybersecurity and has served on the board of advisors of many security technology companies.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: We regularly assess risks from information security threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information security policies, processes, and practices. To protect our information systems from threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts extensive ongoing reviews of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Our Director of IT Security is responsible for assessing, monitoring and managing risks from cybersecurity threats, overseeing our overall cybersecurity risk management program which includes prevention, mitigation, detection and remediation of cybersecurity incidents and supervises a team of cybersecurity personnel. Our Director of IT Security reports to our VP – Information Technology and is responsible for reporting material incidents to our Cybersecurity Risk Management Committee ("CRMC") that includes officers charged with reporting responsibilities. Cybersecurity incidents that meet a pre-determined minimum threshold are communicated upward to executive officers to determine overall materiality and disclosure obligations. Our Director of IT Security keeps the CRMC apprised of our processes to prevent, detect, mitigate and remediate cybersecurity incidents at least annually. Our internal cybersecurity team led by our Director of IT Security has over 75 years of combined experience in information security and maintains several cybersecurity certificates.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Our CISO has over three decades of relevant experience across the information technology landscape. His work experience has included managing cybersecurity risks at large multinational companies. Reporting to our CISO and leading a team of security engineers is our Vice President, Enterprise Security, who also has decades of experience architecting and deploying secure network, system, and data center infrastructure as well as designing and deploying processes and technology platforms that are designed to protect the enterprise from cybersecurity threats. In addition to board oversight and the presence of a cybersecurity team, we provide all applicable employees and contractors with cybersecurity awareness training and testing on an annual basis. We also deliver phishing exercises to all applicable employees and select contractors, as well as targeted phishing training to select employees and contractors, on a quarterly basis. Our product development teams keep current through specialized training on secure development practices for firmware, software, and hardware. Our training programs are designed to educate our employees on current cybersecurity risks and the programs we have in place that are designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: ACUITY INC. (DE)

ticker: AYI


text: We have processes to inform the Directors' Risk Committee, Audit Committee and the Board about risks from cybersecurity threats. Our management team reports its findings using the FFIEC Cybersecurity Assessment Tool and our information security team's determination as to whether our security controls, at a minimum, are in place and effective. The Information Security Officer and Chief Technology Officer regularly report to the Director Risk Committee, Audit Committee and the Board regarding cybersecurity and related threats and trends, changes, control effectiveness and residual risk, the areas where our cybersecurity program may be improved and improvements made to address and remediate issues.

companyName: First Foundation Inc.

ticker: FFWM


text: We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of the May 2023 ransomware incident or any other previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA, "Risk Factors - "Cybersecurity risk."

companyName: SCANSOURCE, INC.

ticker: SCSC


text: On July 10, 2024, we detected unauthorized occurrences on a portion of our information technology (IT) systems. Upon detecting the unauthorized occurrences, we immediately began taking steps to contain, assess and remediate the cybersecurity incident, including beginning an investigation with leading external cybersecurity specialists, activating our incident response plan, and shutting down some systems. As a result of these and other measures, we believe the threat actor was ejected from our IT systems on July 10, 2024.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas. The cybersecurity risk management program includes: assessments designed to help identify material cybersecurity risks to our critical systems, team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls;

companyName: VPR Brands, LP.

ticker: VPRB


text: The CIO has over 25 years of Information Technology experience, 20 of those years leading large programs within the Oil & Gas industry, including mergers and acquisitions, cybersecurity, digital transformation. The CISO also brings over 30 years of Information Technology experience, with almost 20 years of Oil & Gas experience which includes IT & OT Cybersecurity and technology infrastructure.

companyName: HF Sinclair Corp

ticker: DINO


text: As a global cybersecurity provider, cybersecurity risk management is an integral part of our overall enterprise risk management program. We recognize the critical importance that a strong cybersecurity risk management program plays in maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees. We have established processes and procedures for identifying, evaluating, and responding to risks from cybersecurity threats, including any potential unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems, data, or information assets.

companyName: Palo Alto Networks Inc

ticker: PANW


text: We have incorporated industry recognized cybersecurity frameworks and standards into our Cyber Risk Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Risk Program.

companyName: E2open Parent Holdings, Inc.


text: Managing Material Risks and Integrated Overall Risk Management We have developed an Information Security Program (the "Program") as part of our overall Enterprise Risk Management ("ERM") framework to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: For additional information regarding risks faced by the Company from cybersecurity threats, see Item 1A, "Risk Factors - A cybersecurity incident, data breach or a failure of key technology systems could adversely impact our business."

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; and.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Board of Director Oversight The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board, led by the Executive Chairman Alan McKim, who is also the Chief Technology Officer of the Company, has primary oversight responsibilities for cybersecurity risks and therefore has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: CLEAN HARBORS INC

ticker: CLH


text: We employ processes for assessing, identifying, and managing material risks from cybersecurity threats. In conjunction with EBM, Inc., we employ best in class Endpoint Detection and Response with 24/7 SOC at the Endpoints. We also utilize MFA and Geolocation enforcement where available. We continuously monitor and maintain our network infrastructure including consistent vulnerability monitoring and remediation. We also engage in quarterly phishing campaigns as well as cybersecurity awareness training to our end users to keep them vigilant in being able to detect threats.

companyName: Azitra, Inc.

ticker: AZTR


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to, and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: While we have implemented processes to maintain our cybersecurity risk management program, there can be no assurance that our program, including our controls, procedures and processes, will be fully complied with or that it will be fully effective in protecting the confidentiality, integrity and availability of our critical systems and information.

companyName: Oscar Health, Inc.

ticker: OSCR


text: Cigna Information Protection ("CIP") maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets, and its interaction with business, Information Technology ("IT"), and security parties; internal and external. Cybersecurity risks are also periodically reviewed by Enterprise Risk Management ("ERM") to ensure appropriate oversight of cybersecurity risk management activities.

companyName: Cigna Group

ticker: CI


text: D.R. Horton's CIO has 36 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, the D.R. Horton CIO has led governance, risk, and compliance technology programs and information security programs. The D.R. Horton CIO currently reports to the D.R. Horton CFO.

companyName: Forestar Group Inc.

ticker: FOR


text: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to our customer and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Amedisys performs diligence on third parties that have access to our systems, data or facilities that house such systems or data and monitors cybersecurity threat risks identified through such diligence.

companyName: AMEDISYS INC


text: The Company maintains a formal Information Security Program that includes risk assessments regularly conducted by internal resources as well as third-party experts.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We utilize internal information technology resources for the primary aspects of our cybersecurity program. Our internal team is supported by external service providers and consultants as needed.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: The Board of Directors oversees the risk management process, including overall responsibility for overseeing management's establishment and operation of a cybersecurity program. The Board of Directors delegates certain cybersecurity oversight responsibilities to the Risk Oversight Committee, which oversees enterprise risk, vendor management, and information technology risks, and to the Audit Committee, whose oversight responsibility includes cybersecurity risks, data privacy and risk management related to the Company's financial systems. The Risk Oversight Committee has specific responsibility for overseeing information technology processes and controls, including for cybersecurity, data privacy, compliance with related policies, and the process to monitor risks to the Company arising from changing technology trends, and coordinates with the Audit Committee, as needed.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; refines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of our network, infrastructure and computer systems 24x7, 365 days a year. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Annual recurring cybersecurity controls testing program, which includes independent third-party penetration testing, cybersecurity procedures and system testing, and third-party independent network traffic monitoring. • A training and awareness program that educates and tests employees on how to avoid and identify cybersecurity risks. • A Cyber Security Insurance Policy that covers insurance, incident response, incident mitigation, and legal support.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: We have a dedicated team of cyber professionals who report to our Chief Information Security Officer ("CISO"). This team publishes information technology and security policies, measures compliance, and operates a program to mitigate risks and threats. Our risk mitigation activities include network segmentation, cyber protection and containment, detection and reaction, and recovery. This team operates to decrease the risk of cyber incidents having a material impact. We measure our programs against the National Institute of Standards and Technology Cyber Security Framework and regularly test our controls and incident response plans.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary and appropriate, regarding cybersecurity incidents that we may experience.

companyName: Global Net Lease, Inc.

ticker: GNL


text: The audit and risk committee of our Board (the "Audit Committee") oversees risks related to cybersecurity, including the security of corporate information and the steps management takes to monitor and control these risks. Management regularly briefs the audit committee on our cybersecurity risk profile, potential threats, and continuous improvement initiatives. Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, enhancing our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.

companyName: BriaCell Therapeutics Corp.

ticker: BCTX


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Compliance, and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Cybersecurity threats have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the evolving nature of these risks and remain vigilant in our efforts to mitigate potential impacts. Refer to "Item 1A. - Risk Factors" in this annual report on Form 10-K, including, "We could experience a significant disruption in or security breach of our information technology system which could harm our business and adversely affect our results of operations," for additional discussion on our cybersecurity related risks.

companyName: AstroNova, Inc.

ticker: ALOT


text: Our Nominating and Corporate Governance Committee has primary responsibility for overseeing our risk-management program relating to cybersecurity, although our Board of Directors participates in periodic reviews and discussion dedicated to cyber risks, threats, and protections.

companyName: Onfolio Holdings, Inc

ticker: ONFO


text: Cybersecurity risks associated with third-party service providers are managed in accordance with our Third-Party Risk Management (TPRM) program. Components of this program include cybersecurity due diligence and review of contractual terms with third parties that access our network or sensitive information. The TPRM program works to conduct appropriate review of all new third parties and performs ongoing monitoring of our existing relationships based on the risk presented by the third party.

companyName: Unum Group

ticker: UNM