text: Our management team, specifically our President and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.

companyName: PodcastOne, Inc.

ticker: PODC


text: These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity. The Board and/or our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the measures we are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.

companyName: Broad Capital Acquisition Corp

secItem: Item 1C


text: The Advisor and its affiliates take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout their operations that are designed to address cybersecurity threats and incidents. The Advisor and its affiliates regularly assess risks from cybersecurity threats, monitor their information systems for potential vulnerabilities, and test those systems according to their cybersecurity policies, standards, processes, and practices, which are integrated into their overall approach to enterprise risk management. To protect their information systems from cybersecurity threats, the Advisor and its affiliates use various security tools that help them identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Lightstone Value Plus REIT V, Inc.


text: Our executive team including our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: PlayAGS, Inc.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Finance Committee of the Board (the "Audit and Finance Committee") oversight of cybersecurity and other information technology risks, including our plans designed to mitigate cybersecurity risks and to respond to data breaches.

companyName: Seagate Technology Holdings plc

ticker: STX


text: We do not believe that risks from cybersecurity threats, individually or in the aggregate, including any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations. For additional information on how cybersecurity risk may affect our business, refer to Item 1A. Risk Factors of this Form 10-K under the heading "We rely on operating and information systems that may experience a failure, a compromise of security, or a violation of data privacy laws or regulations, which could interrupt or damage our operations and have a material adverse effect on our financial condition, liquidity or results of operations."

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Notwithstanding our processes to oversee and identify risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. To date there have not been any risks that have materially affected our operations. See Item 1A. " RISK FACTORS " for a discussion of cybersecurity risks.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: Our board of directors administers its cybersecurity risk oversight function through our audit committee. Our audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties, and risks relating to cybersecurity incidents. Our board of directors receives quarterly updates from our audit committee on ERM and cybersecurity risks.

companyName: TWILIO INC

ticker: TWLO


text: Our cybersecurity risk management processes include: risk assessments performed by internal personnel and third-party advisors designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environments information security teams principally responsible for developing and implementing (1) cybersecurity risk assessment processes, (2) information security controls, and (3) response plans to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our information security controls cybersecurity awareness training and policies designed to address social engineering attacks targeting employees and contractors cybersecurity incident response plans that include procedures for responding to certain cybersecurity incidents risk management processes for third-party service providers, suppliers, and vendors We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our results of operations, financial condition, cash flows and/or prospects.

companyName: SEMPRA

ticker: SREA


text: Our information security team reviews enterprise level cybersecurity risks at least annually, and key cybersecurity risks are identified, tracked, monitored, and addressed in alignment with our overall enterprise risk management program.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Our information technology team with oversight from our Chief Financial Officer as well as specific resources that manage our production server environment help identify, assess and manage the Company's cybersecurity threats and risks. The team includes credentialed professionals whose experience and current duties include the identification and management of cyber risks. Our information technology team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, internal and external audits, third party threat assessments, conducting vulnerability assessments, use of external intelligence feeds, subscribing to reports and services that identify a cybersecurity threats, and evaluating threats reported to us.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee specifically assists the Board of Directors in its oversight of risks related to cybersecurity.

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: Energy Recovery, Inc.

ticker: ERII


text: In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our most critical systems, data or facilities that house such systems or data, and establish contractual terms and oversight to manage and reduce the risks associated with such third-party vendors. Such contractual terms include requirements to provide notification of cyber incidents involving our systems or data and requirements to provide industry-accepted disclosures, such as SOC 2 Type II reports, on a regular basis.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Our commitment to security is evidenced by our certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171 and FedRamp Additionally, we subject our standards-based certifications to annual audits by third parties and have successfully undergone examinations such as the Health Insurance Portability and Accountability Act (HIPAA), validated by qualified third-party assessors. There were no material cybersecurity incidents experienced by C3 AI during the fiscal year ended April 30, 2025.

companyName: C3.ai, Inc.

ticker: AI


text: Our cybersecurity program is contracted through and led by Harley-Davidson's Chief Information Security Officer (CISO) who is responsible for assessing and managing the Company's information security and technology risks (including cybersecurity). On December 15, 2023, the Harley-Davidson CISO announced his retirement from Harley-Davidson, and since that time, Harley-Davidson's Chief Digital and Operations Officer is serving as the acting Harley-Davidson CISO, executing all of the responsibilities of the CISO while Harley-Davidson conducts a search to fill the position. Harley-Davidson's Chief Digital and Operations Officer has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Our IT Security Department recognizes that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process designed to assess and oversee the cybersecurity practices of our vendors. Before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Our IT Senior Director takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: Our company has engaged a third -party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection and response, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through our company's information systems, the CISO and Incident Response Team ("IRT") will take immediate steps to mitigate the threat and assess any damages. Upon report from the CISO, the SMT will evaluate the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the Security and Exchange Commission's cybersecurity disclosure rule. If deemed necessary, third -party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: As a financial institution we collect, store, and transmit sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and personally identifiable information of our customers and employees. This information can be of significant value to criminal actors, and, as described in "Item 1A. Risk Factors - Risks Related to Cybersecurity, Third Parties, and Technology", cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance. Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "Cybersecurity breaches and other disruptions or misuse of our network and information systems could affect our ability to conduct our business effectively.", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, including education sessions regarding cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts.

companyName: Teads Holding Co.

ticker: TEAD


text: Danaher's cybersecurity strategy and risk management program focuses on maintaining a secure environment for our data that complies with applicable legal requirements and effectively supports our business objectives and customer needs. Our commitment to cybersecurity emphasizes cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention and detection of, and response to, cybersecurity threats. Key elements of our program for assessing, identifying and managing material risks from cybersecurity threats are described below.

companyName: DANAHER CORP /DE/

ticker: DHR


text: g. Our cybersecurity team regularly conduct tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Our cybersecurity risk management program is principally managed by our Global Information Systems team, which is led by our Chief Information and Security Officer, who reports directly to our Chief Executive Officer, as well as our deputy Chief Information Security Officer (deputy CISO). Our Chief Information and Security Officer and deputy CISO combined have more than 40 years of experience in cybersecurity and/or information technology risk management, have relevant certification, and are active in a variety of cybersecurity related boards and organizations. Our Chief Information and Security Officer also serves as the officer who reports directly to senior management and makes regular reports to the Audit Committee and Board of Directors as described in this Item 1C. Under the direction of our Chief Information and Security Officer and deputy CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to enhance our cybersecurity program as needed in response to such developments.

companyName: ACCURAY INC

ticker: ARAY


text: Risk Identification: We have developed risk identification and vulnerability management procedures that address the identification, prioritization, and remediation of cybersecurity vulnerabilities. To facilitate this program, the Company has created cyber risk and incident management procedures and a related risk register to document and monitor potential risks. As discussed below, the Company uses certain third-party tools to identify and manage cybersecurity vulnerabilities. Each risk in the risk register is monitored by one of our cybersecurity members and updates are reported to the CROC as needed.

companyName: Vertiv Holdings Co

ticker: VRT


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent, and effective response to actual or attempted cybersecurity incidents impacting the Company. The plan includes considerations for (1) detection, (2) analysis, which may include timely notice to our Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery, (6) post-incident review, and (7) external reporting through a Current Report on Form 8-K (if deemed material). In addition, we also maintain a formal information security training program for all employees that includes training on topics such as phishing and email security best practices. Employees are also required to complete regular training on data privacy.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: Our internal audit department also reviews our cybersecurity program, processes, policies and controls at least annually. The program also is regularly reviewed in annual external audits and regulatory assessments. Lessons learned from those efforts are used to drive improvements to continually strengthen the cybersecurity program, including controls for data security.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: ZYNEX INC

ticker: ZYXIQ


text: Under the oversight of the audit committee of the Company's board of directors, and as directed by the Company's Chief Executive Officer, the Vice President of Information Technology is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Vice President of Information Technology has more than 20 years of experience with information technology and related systems security matters and processes.

companyName: MARIMED INC.

ticker: MRMD


text: Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.

companyName: EPLUS INC

ticker: PLUS


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, risk and compliance reviews, and meetings with KULR executives. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform vulnerability testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. Key aspects of this risk management program include, but are not limited to: • Identifying the source of a cybersecurity threat; • Assessing the severity of a cybersecurity threat; • Implementing cybersecurity countermeasures and mitigation strategies; • Providing our employees with regular training on cybersecurity and the protection of our information systems; • Maintaining and testing a business continuity and disaster recovery program; • Maintaining insurance coverage intended to address cybersecurity and data breach risks; and • Informing and updating management and, as needed, the Audit Committee and our Board of Directors of cybersecurity incidents that may pose a significant risk for the business.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Our cybersecurity environment emphasizes the role of each individual user in preventing a cyber incident. We have implemented required monthly video-based cybersecurity training. All users are tested on each training module. This training is supplemented by "test" phishing messages to see if users are alert to cyber risks.

companyName: Fresh Tracks Therapeutics, Inc.


text: Our Vice President and Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Prior to his approximately 15 years overseeing and securing our information technology operations, our Vice President and Director of Information Technology held various roles during his approximately 9 years of tenure at USI New England, most recently overseeing and securing their information technology operations as Regional IT Manager. This experience is reinforced with regular cybersecurity training from industry leading organizations such as the SANS Institute and ISC2.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: With respect to cybersecurity incident response, our ECIRP provides a standardized framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.

companyName: Phillips 66

ticker: PSX


text: Our Chief Executive Officer Stanley Chan, with the input and assistance of the management, is responsible for the strategic leadership and direction of the Company's cybersecurity program. Our Chief Executive Officer is also primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: We recognize the importance of maintaining the security of our electronic networks, information systems, and data. We face significant and persistent cybersecurity threats, including risks heightened by the numerous geographies that we serve; our reliance on complex information networks; remote work among certain of our employees; reliance on digital operations to service certain of our customers; and our use of third-party software and services. Our vendors and customers also face cybersecurity threats. A cybersecurity incident impacting our company or any of our vendors or customers could materially adversely affect our operations and/or financial condition. To protect against and prevent cybersecurity incidents, we employ a comprehensive approach where our Board and management teams work together to oversee our cybersecurity program. We are committed to maintaining robust cybersecurity oversight, controls, and strategies that are designed to help us assess, identify, and manage cybersecurity risks.

companyName: Regional Management Corp.

ticker: RM


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management system. The Company has a formalized enterprise risk management program overseen by the Board of Directors and committees of the Board of Directors that addresses strategic, operational, financial, compliance, legal and information technologies and cybersecurity risks. In addition, the Enterprise Risk Management Council ("ERM Council") is a management-level team comprised of senior vice presidents and other business leaders responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on the Company's business and financial results. The ERM Council regularly reports to the Board of Directors on areas of risk and risk management. The Chief Financial Officer serves as the ERM Council Lead. The Chief Audit Executive serves as the ERM Council Process Owner.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Vice President of Information Technology, who is responsible for management of our Information Technology program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Vice President of Information Technology and representatives from Legal and/or Risk Management, as applicable.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT and Legal and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.

companyName: Fluent, Inc.

ticker: FLNT


text: Starwood Capital also periodically performs simulations and tabletop exercises at a management level and utilizes external resources and consultants, as needed. All employees of Starwood Capital are required to complete an annual computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users on how to identify information security threats and what actions should be taken in the event of a cybersecurity breach. Additionally, the employees of Starwood Capital are regularly tested with phishing campaigns reinforcing their awareness of email threats.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Our Head of IT provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties. Our Audit Committee regularly meets with our Chief Financial Officer and Head of IT about the Company's ongoing compliance and risk management and reports to the Board of Directors regularly.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: We maintain comprehensive processes to assess, identify, and manage material risks from internal and external cybersecurity threats, and have integrated such processes into our overall enterprise risk management systems and processes. We regularly assess our cybersecurity threats based on industry leading frameworks, including ISO 27001, ISO 27701 and National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Assessments are performed by dedicated cybersecurity teams led by our Chief Information Security Officer and Data Protection Officer (CISO and DPO) to identify risks related to data loss, theft, misuse and other cybersecurity risks. Following such risk assessments, we design and implement safeguards to prevent and mitigate identified risks based on our risk management methodology. Additionally, we regularly conduct cybersecurity/privacy awareness training, phishing attack simulation training, disaster recovery training and other tabletop exercises to improve our practices.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: Our management team, including the Vice President of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats. The Vice President of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of experience leading technology management functions within biotech companies as well as interacting with the Board. Specifically, the Vice President of IT has been leading IT, compliance and security in various biotech companies including presenting and delivering cybersecurity roadmaps and risk management to executive teams and boards.

companyName: CARGO Therapeutics, Inc.


text: The key components of our future cybersecurity program will include: • conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure; • a third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents; • engagement with external service providers to evaluate, enhance, or support our security measures; and • an incident response plan outlining specific procedures for managing cybersecurity incidents;

companyName: NKGen Biotech, Inc.


text: In the event of a potential cybersecurity incident, the third-party security operations center is authorized to take preemptive action to address the incident and must promptly notify a member of the ISC. The ISC coordinates the response to and communication of an incident in accordance with our Incident Response Plan ("IRP") and applicable law. The IRP is designed to provide guidance for effective, efficient, and orderly response to a variety of cybersecurity incidents. The ISC is responsible for communication escalation as necessary up to and including to the Board of Directors.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our Executive Director, Corporate Information Systems, along with our Chief Legal Officer, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing material risks associated with cybersecurity threats. Our Executive Director, Corporate Information Systems has over 20 years of experience in the life science industry, including a focus in the past four years on information technology management. Additionally, his academic background includes advanced degrees in the life sciences and he brings a strong track record of managing cyber incident responses and related activities. In this role, our Executive Director, Corporate Information Systems works closely with an internal team that includes resources with various cybersecurity certifications and leverages the support of our external information security firm, technology partners and an industry-leading intelligence platform. Our Executive Director manages and leads the internal Information Technology team to maintain, update and enhance the Company's technology infrastructure and corresponding safety measures, as well as to ensure that appropriate safety measures are implemented to protect against evolving cybersecurity threats.

companyName: Vericel Corp

ticker: VCEL


text: To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risks Related to Data Privacy and Cybersecurity" in Item 1A, Risk Factors, of this Form 10-K.

companyName: GAP INC

ticker: GAP


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and various supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers which includes, depending on the vendor, nature of the services provided, and sensitivity of the Information Systems and Data at issue: different levels of assessment designed to help identify cybersecurity risks associated with the vendor, security questionnaires, review of security assessments, and imposition of contractual obligations related to cybersecurity.

companyName: PagerDuty, Inc.

ticker: PD


text: The information provided by these assessments is used to improve our enterprise information security program, including cybersecurity policies, standards, processes and practices. In addition, the results of significant assessments are reported to management and the Audit Committee of our Board of Directors (the "Board").

companyName: MKS INC

ticker: MKSI


text: Our Director of Information Technology leads our information security organization and reports to our Chief Executive Officer and Chief Financial Officer on matters related to cybersecurity who then in turn report to the Board of Directors any material information regarding such cybersecurity matters. Our Director of Information Technology has over 30 years of IT experience and has developed a focus of experience in the healthcare industry.

companyName: Solana Co

ticker: HSDT


text: Steve Holt is our Chief Information Officer, a role he has had since he joined Materion in November 2017. Mr. Holt has 40 years of experience in the information technology industry. Prior to joining Materion, Mr. Holt served as Chief Information Officer at Chart Industries as well as other IT-focused positions at TechnOptics, Accuride Corporation and Navistar.

companyName: MATERION Corp

ticker: MTRN


text: We have established an enterprise risk management (ERM) program that considers our enterprise strategy, information from internal stakeholders, and information from external sources (e.g., emerging risks and trends, evaluations by third parties, and best practices) to identify, assess, categorize, and monitor risks including cybersecurity risks. The ERM program develops enterprise risk profiles to address individual risk drivers, develop action plans, and monitor against key risk indicators. At least annually, the ERM program is presented to our Board, Audit Committee, and members of management.

companyName: TENNANT CO

ticker: TNC


text: Related to Cybersecurity Risks Our third-party managed IT service provider reports to our Chief Financial Officer, Chief Accounting Officer, and Chief Operating Officer on cybersecurity matters, including cybersecurity risks. These senior executives are involved in management of information security procedures and periodically brief the board of directors on information security matters.

companyName: Terreno Realty Corp

ticker: TRNO


text: Additionally, we engage an external firm to conduct an annual System and Organization Controls 2 Type 2 examination of certain cybersecurity controls. Our internal audit organization also provides independent assurance of the cybersecurity program through related audit engagements to complement external assessments and reviews. Additional third parties are engaged, as needed, to perform risk assessments, penetration testing, and other services related to cybersecurity. We rely on third-party cybersecurity software tools and services to enhance many of our cybersecurity functions, such as incident logging, network monitoring, security operations, and data loss prevention, among others. Additionally, we carry cybersecurity insurance to help reduce financial risk posed by cybersecurity incidents.

companyName: Unum Group

ticker: UNM


text: LivaNova's CISO has a Master of Science in Accountancy with a specialization in risk management, in addition to over 15 years of experience in the IT Risk Advisory sector. The CISO leads the Company's information security team, identifies cybersecurity threats, and implements countermeasures in the cybersecurity realm, considering both internal operations and the external landscape. As part of his duties, the CISO provides relevant information in connection with regular enterprise risk assessments. The CISO also manages the Company's ISMS program. Guided by the principles of various industry-leading standards, such as the NIST cybersecurity framework and ISO 27001, the objective of the ISMS program is to continue to strengthen LivaNova's cyber resiliency in connection with its information technology systems.

companyName: LivaNova PLC

ticker: LIVN


text: BXINFRA's Board of Directors and its Audit Committee are responsible for understanding the primary risks to our business. The Audit Committee is responsible for reviewing BXINFRA's and the Sponsor's IT security controls with management and evaluating the adequacy of BXINFRA's and the Sponsor's IT security program, compliance and controls with management.

companyName: Blackstone Infrastructure Strategies L.P.


text: Our Board provides strategic oversight on Cybersecurity matters, including material risks associated with Cybersecurity threats. The Board has delegated to the Audit Committee oversight of Cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our Cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our Cybersecurity preparedness, information on the current threat landscape, and material risks from Cybersecurity threats and Cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of Cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.

companyName: JFB Construction Holdings

ticker: JFB


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed by such providers. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.

companyName: MARINEMAX INC

ticker: HZO


text: The Company employs third-party risk security vendors to identify, mitigate, and remediate cybersecurity risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful. The Company employs a third-party vendor to securely host the Company's data in a cloud-based storage system. The third-party vendor conducts quarterly vulnerability scans on both the hosted data environment and the Company's corporate data network. Scans of the Company's firewall are conducted regularly by the third-party vendor. Any necessary remediation would also be provided by the third-party vendor after the scan, but none has been required. The Company uses multiple third-party developed software to continually monitor technology systems for viruses, malicious software, executable harmful files, and other cybersecurity risks. The Company requires the annual submission of SOC 1 security certificates from our third-party vendors which have access to our financial and sales data. The Company also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity related incidents.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our CIO has more than 30 years of experience, including from his prior business and technology leadership roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company. Our CISO has more than 20 years of cybersecurity experience. Prior to joining us he was Senior Vice President, Chief Information Security Officer at Brighthouse Financial, served as Technology Vice President & Chief Information Security Officer for GE Healthcare and started his career at Allstate Insurance Company. He also holds security, privacy and risk certifications, including Certified Information Systems Auditor, Certified Information Security Manager and Certified Information Systems Security Professional.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: We do not believe any risks from cybersecurity threats (including from any prior cybersecurity incidents) have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurances, however, that we or our business partners or suppliers will not experience a future system disruption, attack or security breach that materially impacts our business, operations, results of operations, or financial condition. For more information refer to "Item 1A. Risk Factors, General Risks, We are increasingly dependent on the continuous and reliable operation of our information technology systems, and a disruption of these systems or significant security breaches could adversely affect our business."

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity service providers and consultants, to augment and support our employees with defined information security responsibilities. Cybersecurity event and threat information is collected and monitored by third-party service providers and reviewed regularly by IT personnel and management. When an event is deemed a security incident, information technology and business management are informed in accordance with our Incident Response Plan ("IRP"). Our information security program and our IRP are managed by our Senior Vice President, Information Technology, who has over 15 years of experience and has held senior leadership roles at a Fortune 250 organization. Depending upon the nature and scope of an incident, our IRP contemplates engaging with other members of management and, potentially third-party experts, in a collaborative and cross - functional approach to enable timely assessment and escalation of incidents.

companyName: Sovos Brands, Inc.


text: In the course of our business operations, we collect, store, and process data, including information related to our employees, partners, collaborators, and vendors. To effectively manage cybersecurity risks, we have established a range of policies and procedures designed to prevent, detect, and respond to potential threats. Our Chief Executive Officer manages our external IT and cybersecurity experts. Under the CEO's direction, we work with trusted third-party information technology "IT" professionals who employ a variety of software tools to ensure the security of our systems. Additionally, we rely on reputable cybersecurity software vendors to further enhance our protection.

companyName: Solidion Technology Inc.

ticker: STI


text: We appreciate the need to monitor and test our systems to make sure that they are working the way that they should. We negotiate with our vendors about a variety of monitoring, testing, and reporting provisions so that we can work with them to better address vulnerabilities. This may include sharing SOC 1 or 2 Type 2 audit reports, conducting periodic penetration and vulnerability testing, both internally and externally, and confirmation that vendors are adhering to applicable laws. Some of this testing and monitoring is conducted in-house and some is conducted by third-party vendors.

companyName: Portillo's Inc.

ticker: PTLO


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Crisis Management Policy that guide our response to cybersecurity incidents; and • a third-party risk identification and management process for service providers.

companyName: SLM Corp

ticker: SLM


text: Our Chief Business Officer and other members of senior management are primarily responsible to assess and manage our material risks from cybersecurity threats. We have engaged a third party, who authored security manuals and holds multiple industry certifications, as our Virtual Chief Information Security Officer (VCISO) to support our Head of IT in Cyber related architecture and assessment.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: In 2025, the oversight over the Company's cybersecurity risk will transition from the Audit Committee to the Board of Directors ("the Board") to align with the Board's oversight of operational risks.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: Our Board of Directors plays a pivotal role in overseeing the organization's preparedness for cyber threats. This involves a comprehensive understanding of our risk profile, ensuring appropriate cybersecurity controls are in place, regularly reviewing the effectiveness of these measures, and maintaining a robust incident response plan. The Board's involvement extends beyond compliance and budget approvals to active participation in continuous cybersecurity strategy improvement.

companyName: ATIF Holdings Ltd

ticker: ZBAI


text: The Information Security team maintains a Third-Party Risk Vendor Management Program that requires all third-party vendors with access to our systems or sensitive information comply with applicable cybersecurity standards and regulations. Ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies are performed, if applicable.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Impacts from Cybersecurity Threats Although we have experienced cybersecurity incidents, we do not believe they have, or are likely to have, a material impact on the business. However, we recognize that cybersecurity threats are constantly evolving, and future incidents remain a possibility. Despite our security measures and IT controls, we cannot guarantee that future cybersecurity incidents will be prevented. A successful attack could have significant consequences for the business. For more information on the risks associated with cybersecurity threats, see "Item 1A, Risk Factors."

companyName: STAR GROUP, L.P.

ticker: SGU


text: The Company's Information Security and Privacy team is led by the VP of Information Security and Privacy who reports to the Company's Chief Financial Officer. She joined the Company in 2003 and has more than 30 years of relevant experience. Before joining the Company, she served as the federal government and southeast region leader of Guardent (now part of Verisign), a security and privacy consulting and managed security services company. Prior to Guardent, she worked at PricewaterhouseCoopers LLP in the Technology Risk Services consulting practice. She is a strategic advisor to several organizations in the information security and privacy field and is a Certified Information Systems Security Professional (CISSP), and a Certified Information Privacy Professional (CIPP).

companyName: Graham Holdings Co

ticker: GHC


text: Our cybersecurity and information security program also includes review and assessment by external, independent third parties, with whom we periodically consult on threat assessments and security enhancements, and incident response preparedness. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. Additionally, the Company uses a third-party risk management program that assesses risks from vendors and suppliers. In response to these assessments, we have developed contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Our Chief Risk Officer reports to our CEO, and our Chief Risk Officer and/or Chief Information Security Officer provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing and activities of third parties. Our audit committee provides updates to the Board of Directors on such reports. We also have an established incident response plan led by our Chief Information Security Officer that lays out the process for the assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, our process, including those set forth in the incident response plan, provides for escalation and notification to management, the audit committee and the Board of Directors and/or external parties, as appropriate.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Other than with respect to the Cyber Incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology, Cybersecurity and the Cyber Incident" of this Annual Report on Form 10-K.

companyName: SolarWinds Corp


text: Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks The principal objectives of our Cyber Risk Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property and other assets of E2open, and those of our customers, vendors, partners, employees and consumers that can be at risk due to cybersecurity threats to E2open.

companyName: E2open Parent Holdings, Inc.


text: Security is governed by the Security Advisory team, an executive advisory committee composed of company officers, including our chief executive officer, our chief financial officer and our chief enterprise services officer. The Security Advisory team meets regularly to evaluate ongoing security threats and incidents, to define policy and to prioritize initiatives. Identified cybersecurity threats and incidents are monitored and assessed for materiality by this cross-functional Security Advisory Team. This assessment includes whether our Board of Directors should be informed of a threat or incident.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Our management is responsible for day-to-day administration and management of our cybersecurity program and for informing the audit committee of cybersecurity risks. We may also work with external security service providers to support our security monitoring and threat detection capabilities. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our information technology team overseen by the Executive Chairman. With over twenty-five years of technology development experience in the financial services industry, our Executive Chairman is familiar with our technology infrastructure and risk profile. Our information technology team tests our infrastructure for known cybersecurity risks and leads our employee training program on matters related to cybersecurity. The Executive Chairman and information technology team seek to implement and oversee processes for monitoring our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a potential breach is identified, it is raised to the attention of senior management to help mitigate any further vulnerabilities.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: (b) Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management strategy.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: The Board oversees the Company's risk associated with cybersecurity matters with the support of the Risk Committee of the Board (the "Risk Committee"). Management is responsible for identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. All employees, including members of our information technology ("IT") team, are also required to report any known or suspected security event, pursuant to our policies and procedures.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Our cybersecurity program is run by a third-party firm, which reports to our Chief Financial Officer (" CFO "). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CFO regularly reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks, and resiliency against incidents. Our cybersecurity risk management processes include accessing security controls, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We engage a third-party information security officer who maintains, monitors, and ensures the security of our digital assets. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products. We maintain security programs that include physical and technical safeguards. We monitor cybersecurity vulnerabilities and potential attacks, and we evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We continue to integrate our cyber practices into our enterprise risk management practices, which is overseen by our Board of Directors. In addition, we assess the risks from cybersecurity threats, periodically engage third-party tools to assist us in enhancing and monitoring our cybersecurity risks, primarily spam and suspicious email filters, and regularly back up company information.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Management, with the assistance of third party service providers, routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company's Chief Legal Officer.

companyName: Root, Inc.

ticker: ROOT


text: As part of its Standard Operating Procedures, RPC has adopted Incident Response Policy (IRP), Data Classification and Handling Policy, and other policies regarding key areas of information security. These policies are reviewed periodically and updated as needed to address emerging risks or gaps in compliance. The IRP also includes guidance on internal and external escalation in the event of an incident or breach. RPC has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed by the cybersecurity team to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. The IRP provides for consultation with outside legal counsel and our independent registered public accounting firm as appropriate, including on materiality analysis and disclosure matters, to make the final materiality determination regarding disclosure and other compliance decisions.

companyName: RPC INC

ticker: RES


text: While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of our hotel managers, which are the third-party operators of our hotels and resorts, or of our franchisors. We set clear expectations of our hotel managers and franchisors regarding cybersecurity, but we rely on our hotel managers and franchisors for managing their cybersecurity risk. We conduct surveys of our hotel managers and franchisors to assess their cybersecurity risk management programs and procedures, to identify gaps and request remediation and to understand our risk exposure. Many of our hotel managers and franchisors carry cyber insurance policies to protect and offset a portion of potential costs incurred from a security breach. Additionally, we currently have cyber insurance policies to provide supplemental coverage above the coverage carried by our hotel managers and franchisors.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: We recognized the significance of cybersecurity in our business operations. Therefore, we have established a comprehensive cybersecurity and risk management framework, which includes regular cybersecurity risk assessments to identify and evaluate potential cyber-attack threats and information security weakness that may affect our business. We plan to implement a series of preventive measures, including firewalls, cyber-attack detection systems, and data encryption, to safeguard confidential information and data. We will regularly conduct cybersecurity awareness training for employees to enhance their awareness of potential cybersecurity threats and ensure they take appropriate preventive measures.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: We maintain an information security program and governance framework that is designed to protect our information systems against operational risks related to cybersecurity.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include: an incident response plan and procedures, incident detection and response playbook, business continuity plans, encryption of certain data, network security controls, identity management and access controls, physical security controls, 24/7 systems monitoring, vendor risk management processes, employee cybersecurity and privacy training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: MACROGENICS INC

ticker: MGNX


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with our information technology provider, who leads testing of our compliance with standards, remediation of known risks, and our employee training program. information technology providers lead our implementation and oversight of processes for the regular monitoring of our information systems.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: Our chief information security officer and chief compliance officer are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.

companyName: BOX INC

ticker: BOX


text: We have processes in place designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. Our cybersecurity risk management processes are integrated into our enterprise risk management program.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Integration into our Risk Management Framework Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework. Technology is one of the five primary risk categories addressed by the ERM framework, and cybersecurity is identified as a subcategory of the technology risk. Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Senior Director of Information Security (SDIS) and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF. Our internal ERM leadership meets regularly with our technology leadership team to review developments in our technology risk profile and works with the cybersecurity team to monitor key risk indicators linked to our cybersecurity risks. Any changes to the threat landscape are discussed and considered as adjustments to our risk profile.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Management and Board Oversight of Cybersecurity Risks Our cybersecurity program is managed by the Information Security Officer who leads our IS team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Officer provides periodic reports to the IT Committee and Board of Directors. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Bioventus maintains a cybersecurity risk management program that is designed to enable us to assess, identify, and manage risk associated with cybersecurity threats (the "Cybersecurity Program"). Our Cybersecurity Program is based on standards promulgated by the National Institute of Standards and Technology ("NIST") and the United States Cybersecurity and Infrastructure Security Agency ("CISA") and includes the following elements: • Identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by CISA. • Technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness. • Processes designed to detect the occurrence of cybersecurity events and to respond to and recover from cybersecurity incidents. • A third-party risk management process designed to manage cybersecurity risks associated with our service providers, suppliers, and vendors.

companyName: Bioventus Inc.

ticker: BVS


text: Our Board of Directors has charged the Audit Committee with oversight of the Company's identification, assessment, and management of cybersecurity and data privacy risks. As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk. Our Chief Information Security Officer ("CISO") and Chief Technology Officer ("CTO") manage our network operations and software development across corporate and franchise locations. The Board of Directors receives regular updates from the CISO and CTO regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.

companyName: JACK IN THE BOX INC

ticker: JACK


text: The cybersecurity team collaborates with leaders in management to assess materiality, align on a remediation roadmap, and comply with disclosure requirements. On an ongoing basis, the board of directors and the audit committee oversee Astrana's cybersecurity risks and remediation strategies to prevent and mitigate cyberattacks.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The CISO leads an Information Security Steering Committee ("ISSC") which convenes expertise from areas beyond the information security and technology departments, including risk, legal and operations, or other departments, as necessary. Accordingly, the ISSC provides for an interdisciplinary expertise in the implementation of our cybersecurity risk management program. The CISO reports on behalf of the ISSC to management's Risk Committee. These reports include information on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents.

companyName: Federal Home Loan Bank of Indianapolis


text: As discussed in more detail under the heading "Governance" below, our Board and management devote significant time to cybersecurity risk oversight. The Board annually reviews our overall cybersecurity risk profile to help ensure that sensitive data remains secure in an ever-changing threat landscape, including risk preparedness and mitigation strategies. This assessment considers a range of factors, including our business objectives, the threat landscape, industry trends and regulatory requirements. The Audit Committee of the Board ("Audit Committee") spearheads the oversight of our cybersecurity risk management and regularly meets, not less than quarterly, with our Chief Information Security Officer ("CISO") and other members of management, including those with significant roles in our cybersecurity efforts. Our Executive Steering Committee, described below, provides senior management oversight to our cybersecurity program.

companyName: PROS Holdings, Inc.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks, including those from cybersecurity threats, to its audit committee.

companyName: G1 Therapeutics, Inc.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: At the present time, risks from cybersecurity threats have not materially affected the Company. However, cybersecurity threats have the potential to significantly impair our operations and the operations of the various third parties upon whom we rely.

companyName: FONAR CORP

ticker: FONR


text: The General Partner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.

companyName: NESTOR PARTNERS


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation and periodic assessments of third-party service providers to assess cyber preparedness of key vendors.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: cybersecurity controls, (4) external dependencies, and (5) cyber incident management and resilience. All domains are currently assessed at an evolving maturity level which is in line with our organizations inherent risk assessment score.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: The Company maintains an extensive and structured enterprise risk management (ERM) program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective. The ISO Committee meets quarterly and is chaired by the Company's Chief Risk Officer and is comprised of the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Privacy Officer and top leaders of each of the Company's operating units. The Company's CISO, Chief Information Officer and Chief Technology Officer are also participants on the ISO Committee and the Chief Audit Executive, who reports to the Company's Audit Committee, is an observer. The CISO provides regular reports to the ISO Committee which are shared with the Company's Board of Directors.

companyName: First American Financial Corp

ticker: FAF


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Executive Vice-President and Chief Financial Officer and President and Chief Executive Officer. Our Executive Vice-President and Chief Financial Officer is part of our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Repare Therapeutics Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.

companyName: Rubrik, Inc.

ticker: RBRK


text: Implementation of a multi-layered defense strategy to fortify information protection. Technical, physical, and administrative control redundancies are deployed to ensure multiple layers of protection are in place against cyber threats. Control design and operating effectiveness is tested regularly by independent audit firms and reported to senior management and the Audit Committee of the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: • Engagement of third-party service providers. The Company utilizes third-party cybersecurity experts to assess the Company's cybersecurity risks and conduct penetration testing to measure our cybersecurity risk management program relative to industry-standard frameworks. The Company has established a standardized process for assessing and managing potential risks associated with the engagement of third-party service providers that request access to the Company's information systems. • Incident response. The Cybersecurity Incident Response Team ("CIRT"), deploys, maintains, and monitors various tools and processes designed to safeguard against and detect cybersecurity incidents that may occur. As part of our incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. In accordance with established written policies and procedures, escalation protocols are used to provide information to, and engage with, executive management, the Cybersecurity Committee and the Board, throughout the incident response process. The CIRT reviews these controls regularly, and makes enhancements as needed to incorporate lessons learned, updated industry standards, and any new or revised legal requirements.

companyName: JABIL INC

ticker: JBL


text: Risk Management and Strategy have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework. The cybersecurity risk management program is integrated into our Enterprise Risk Management (ERM) program.

companyName: Electromed, Inc.

ticker: ELMD


text: Third parties also play a role in our cybersecurity. We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks. Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to align with industry standards such as, for example, the Payment Card Industry Data Security Standards.

companyName: BEST BUY CO INC

ticker: BBY


text: CoreSite maintains several certifications related to cybersecurity processes for nearly all of its data center facilities, including: (i) System and Organization Controls (SOC) 1 Type 2 examination; (ii) SOC 2 Type 2 examination; (iii) International Organization for Standardization (ISO/IEC 27001); (iv) National Institute of Standards and Technology Publication Series 800-53 (NIST 800-53) attestation based on the high-impact baseline controls and additional Federal Risk and Authorization Management Program (FedRAMP) requirements for a subset of control families applicable to colocation services; (v) Payment Card Industry Data Security Standard (PCI DSS) validation; and (vi) Health Insurance Portability and Accountability Act (HIPAA) attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Cybersecurity is an important part of our enterprise-wide risk management processes and an area of focus for our Board and management. The entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues. Our Chief Information Officer is responsible for overseeing cybersecurity and reports to the Board at all its regular quarterly meetings regarding matters of cybersecurity. These reports include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and updating the status on defensive security measures and risk assessment and key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: The Company's IT department, in coordination with the Company's legal department, Chief Financial Officer ("CFO"), and as needed Steel Partners Holdings' IT department (collectively, the "Data Breach Response Team"), works collaboratively to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Policy. The Company's response planning is reviewed annually and kept up to date with industry developments.

companyName: Steel Connect LLC


text: The Board is responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls. The CISO has regular and direct communication with the Board, providing a cybersecurity report to the Board's Risk Committee on a quarterly basis (more frequently as events warrant), as well as a written cybersecurity report and briefing to the full Board on an annual basis, in order to inform directors of the state of the Company's Cybersecurity Program. These reports cover, but are not limited to, the Company's cybersecurity posture, overall status of the Company's compliance with the Cybersecurity Program, threat environment, material cybersecurity risks and events, Cybersecurity Program improvements and effectiveness, and other material matters related to the Cybersecurity Program.

companyName: OneMain Holdings, Inc.

ticker: OMF


text: Material Cybersecurity Risks, Threats & Incidents While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that, to our knowledge, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Risks Related to our Business," which should be read in conjunction with the foregoing information.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Management's Responsibilities Our cybersecurity risk management program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who are responsible for our information security strategy, policies, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CIO has over 25 years of information technology and program management experience, addressing complex information technology and cybersecurity challenges for large-scale enterprises in the U.S. Department of Defense, U.S. federal agencies, and commercial organizations. Our CISO, a Certified Information Systems Security Professional ("CISSP"), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Cybersecurity governance at the Company involves executive and Board oversight. Our Board of Directors considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee regularly receives updates from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with less impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: We have experienced, and may in the future experience, whether directly or through our supply chain partners, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on the Company, future cybersecurity incidents, including breaches, could have a material impact on our business, operations and reputation. For additional information about the Company's cybersecurity risks, please refer to "Technology Risks" in Item 1A, Risk Factors.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Consistent with our cybersecurity risk management policies and controls, we have prepared an incident response plan with several components, including: (i) engagement of a third party security operations center for regular vulnerability scanning and technical monitoring of our systems, (ii) detection and analysis of cybersecurity incidents that present risk of unauthorized access to company assets, including the escalation and triaging of incidents that present acute risks to our business, (iii) containment, eradication and data recovery, and (iv) post-incident analysis. Such incident responses are overseen by leaders from our information technology, finance, legal and compliance teams.

companyName: uniQure N.V.

ticker: QURE


text: The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an important component of our overall risk management strategy. HighPeak Energy's cybersecurity team consists of certain of our executive officers as well as internal and third-party cybersecurity personnel. The cybersecurity team, led by professionals with cybersecurity expertise across multiple industries, takes a cross-functional approach to addressing these risks and engages in discussions with the Board and our executive management team on an as-needed basis.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: To date, the Company is not aware of any cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, as discussed under the heading "We depend on information technology systems and maintain protected personal data, and a cyber-attack or other breach affecting these information technology systems or protected data could have a material adverse effect on our results of operations" in Part I, Item 1A, "Risk Factors," the Company remains subject to evolving cybersecurity risks that could have adverse impacts. NEOGENOMICS, INC.

companyName: NEOGENOMICS INC

ticker: NEO


text: As part of its oversight responsibilities as it relates to the Company's overall risk management, the Company's Board of Directors has designated cybersecurity oversight as a full board responsibility. The Board of Directors is mindful to have members with cybersecurity expertise represented on the Board of Directors. The CIO provides monthly reports to the Board of Directors regarding cybersecurity related matters and presents cybersecurity updates to the full Board of Directors at each Board meeting. The Board of Directors also participates in regular training and educational efforts to stay current on relevant cybersecurity related topics.

companyName: LINDSAY CORP

ticker: LNN


text: The Risk Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Risk Committee reviews these reports and discusses them with management. The Risk Committee reports to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Risk Committee.

companyName: NewtekOne, Inc.

ticker: NEWT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" in Part I, Item 1A herein.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Adient recognizes the critical importance of cybersecurity risk management, strategy, and governance. Adient's focus is protecting its valuable assets and data, ensuring business continuity, and maintaining trust with customers and stakeholders. Adient's cybersecurity risk strategy involves assessing and prioritizing potential threats, implementing robust security controls, maintaining an incident response plan and building plans to restore business capabilities and services, allowing prompt return to normal operations. Continuous monitoring and regular updates are essential to detect and respond to threats in real-time. While providing users with clear guidelines and regular updates, ensuring leadership is informed about potential risks and mitigation strategies, the Adient IT leadership team keeps executives updated on the overall cybersecurity posture and any significant incidents, while maintaining transparency with customers and shareholders.

companyName: Adient plc

ticker: ADNT


text: The results of our SOC 2 and PCI assessments are annually reported to the Cybersecurity Risk Subcommittee. Both the Subcommittee and the Board receive regular reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. The Board also oversees our annual enterprise risk assessment, where we assess key risks within the company, including cyber security and technology risks.

companyName: AGILYSYS INC

ticker: AGYS


text: The Company's Chief Information Officer (CIO) possesses a wealth of information technology expertise and has served in various technology leadership roles across multiple industries. They are responsible for all technology systems, services, and solutions. The cybersecurity function reports directly into the office of the CIO.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Our Chief Information Security Officer ("CISO") provides oversight and direction for the Program and coordinates with other corporate functions and business segments to address all aspects of the Program, including recommending adjustments in response to changes in technology, internal or external threats, business processes, and regulatory or statutory requirements, and communicates the information security risk posture of Corebridge to the relevant internal individuals, committees and departments, including as further described below.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Maintenance of IT assets, including daily security patch management. Periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts (Multi-factor authentication enforced). Network integrity is safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, spam gateway filtering, data loss prevention policies, SaaS monitoring, and remote monitoring on all devices. Industry-standard encryption protocols on workstations and email, critical data backups, and infrastructure maintenance. Incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation are maintained and supplied by a third party Security Operations Center (Solutions Granted) that is NIST 800-171 compliant.

companyName: RenX Enterprises Corp.

ticker: RENX


text: Our CSWAT is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Information security metrics are reported quarterly to the Information Technology Steering Committee, the Enterprise Risk Management Committee and the Board Risk Committee to provide evidence of the effectiveness of these controls and tools. Any identified specific gaps in the controls are sent to management quarterly until resolved.

companyName: Sterling Bancorp, Inc.


text: We invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Additionally, Ford is a member of the Financial Services and Information Technology ISACs and both a founding member and board member of the Automotive ISAC. Ford's membership with these industry cybersecurity groups assists in the efforts to protect Ford and Ford Credit against both enterprise and in-vehicle security risks.

companyName: FORD MOTOR CREDIT CO LLC