text: Cole Naus is our CISO. Mr. Naus has over 10 years of experience in the cybersecurity industry. Mr. Naus holds a degree in Cybersecurity and Information Assurance and holds other cybersecurity certifications. Mr. Naus reports directly to Cara Babachicos, our CIO. Ms. Babachicos has over 20 years of experience in the cybersecurity industry, having previously worked as Chief Information Officer at other companies in the healthcare industry.

companyName: InnovAge Holding Corp.

ticker: INNV


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee, customer and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular vulnerability testing on our systems, incident simulations and routine review of our policies and procedures to identify risks and adapt our practices. We engage certain external parties, including a managed security service provider, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to ensure our cybersecurity oversight.

companyName: Syros Pharmaceuticals, Inc.

ticker: SYRS

secItem: Item 1C


text: b. Security Team Expertise: Our security team, led by our Chief Information Security Officer (CISO), who oversees our cybersecurity risk assessments, the implementation of security controls, and the coordination of our incident response efforts.

companyName: KALTURA INC

ticker: KLTR


text: Our Vice President of Information Technology and Security has over 25 years of experience in IT and has held a variety of IT roles across multiple business lines within the financial services, aviation, and hospitality industries. He received both his bachelor's and master's degrees in information management and holds Certified Information Systems Security Professional ("CISSP") certification.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Our full Board of Directors provides oversight for our cybersecurity program. At least annually, the CISO and the VP of Information Technology report to the Board of Directors on information technology, cybersecurity and information security-related matters, including relevant business activities, key risks and mitigation efforts, prior incidents, results of assessments and monitoring, and the potential impact on the Company's business.

companyName: Keenova Therapeutics plc


text: Our engineering security team, led by our Chief Information Security Officer, or CISO, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats. This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to improve.

companyName: Snap Inc

ticker: SNAP


text: In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity department provides reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures.

companyName: Hyatt Hotels Corp

ticker: H


text: Under the oversight of the audit committee of the Company's board of directors, the Company's Chief Executive Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.

companyName: MDWerks, Inc.

ticker: MDWK


text: Engagement of Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, so that we can better understand the current and evolving cybersecurity risks and strategies. Our collaboration with these third-parties includes periodic audits, threat assessments, and consultation on security enhancements.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Our cybersecurity risk management program includes, among other elements: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. • A Security team, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test, respond to or otherwise assist with aspects of our security controls, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training for employees in specific incident response roles, as well as for employees with specific access to systems, devices, or locations, and targeted cybersecurity incident simulation training held on a recurring basis. • Incident response playbooks and standard operating procedures outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, responses may involve escalating notification to our Chief Executive Officer and our board of directors. • Post-incident reviews are conducted for major incidents, and to determine steps that may be taken to mitigate identified risks and reduce the likelihood of reoccurrence. • Internal policies designed to protect our systems and operations, including (1) a data classification and labelling standard to evaluate the confidentiality level of internal information, (2) a cloud continuity policy to address experience disruption for cloud customers, and (3) a business resilience policy to provide a framework for operations during and after disruption events. • A third-party risk management process for service providers, suppliers, and vendors. Such service providers are subject to risk tiering, security risk assessments, and recurring reviews, as applicable. When third-party provider incidents occur, we assess their materiality to our operations and investigate accordingly.

companyName: Atlassian Corp

ticker: TEAM


text: As of the date of this report, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: EMCORE CORP


text: All suspicious activity involving the Information Systems affecting the Trust recognized or uncovered by personnel should be promptly reported to his or her supervisor and/or the CISO; and A Supervised Person must immediately notify his or her supervisor and/or the CISO to report a lost or stolen laptop, mobile device, and/or flash drive. There have been no cybersecurity incidents since the Trust has been founded.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our IT Manager and Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: Precipio, Inc.

ticker: PRPO


text: In 2023, a threat actor representing to be the Sphere 3D Corp. ("Sphere 3D") CFO inserted themselves into an email exchange between the Sphere 3D CFO and the Company's former CEO, which also included Sphere 3D's CEO, regarding the transfer of Sphere 3D's BTC from the Company's wallet to Sphere 3D's wallet. The threat actor requested that the BTC be transferred to an alternate wallet. As a result, 26 BTC, with a value of approximately $560,000 at the time, was transferred to a wallet controlled by the threat actor. Via counsel, Gryphon engaged with US Federal law enforcement to recover the BTC. Despite these attempts by law enforcement to recover the BTC, recovery was not possible.

companyName: American Bitcoin Corp.

ticker: ABTC


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident that could have a material negative impact. For more information about these risks, please see "Item 1A. Risk Factors - Cyber-attacks and other security threats and disruptions could have a material adverse effect on our business" in this annual report on Form 10-K.

companyName: Terran Orbital Corp


text: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Monitoring Cybersecurity Incidents The vCISO is informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The vCISO provides structure for clear processes to ensure the regular monitoring of our information systems. At Rhinebeck Bank, this includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our partnership with DeepSeas Security allows us to be equipped with a well-defined incident response plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Although our CISO resigned in January of 2025, we have elevated an internal candidate to the role of interim CISO while we search for a replacement. As designed, our CISO and CCO are members of the management team and are primarily responsible for assessing and managing our material risks from cybersecurity threats, as well as our overall cybersecurity risk management program. As designed, our CISO is responsible for supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our interim CISO's experience includes over 20 years of helping to build global cybersecurity programs in various industries. Our CCO, who is responsible for our technology risk management program, has over 25 years of experience building and leading risk management and compliance programs in large institutions across multiple geographies.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: The information security team also has processes in place to inform and update management and, as needed, the audit committee about cybersecurity incidents that may pose significant risk to the company. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."

companyName: Blueprint Medicines Corp


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an information technology (IT) steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Playbook. The CISO reports directly to our Chief Information and Digital Officer (CIDO), who is a member of our Executive Committee and leads our information technology, cybersecurity, digital health, and advanced analytics and data science functions. Our CIDO in turn regularly updates our Executive Committee on cybersecurity matters. Our CISO and CIDO have significant experience managing global cybersecurity threats across the pharmaceutical, technology, entertainment, and defense industries. In addition to providing regular updates to the CIDO and his staff, the CISO is a member of our Executive Information Security Governance function (EISG), which meets regularly and is also composed of executive and senior leadership from a variety of functions, including information security, legal, finance, audit, and ethics and compliance to assess and manage cybersecurity developments and risks and our internal programs. Each of the CIDO, the CISO and the EISG may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.

companyName: ELI LILLY & Co

ticker: LLY


text: Our corporate cybersecurity team is responsible for operating our cybersecurity risk management program. The cybersecurity team determines with management an annual workplan for risk assessments, reviews, audits and tests. The cybersecurity team also conducts vulnerability assessments, security reviews and penetration tests on a regular basis in accordance with such workplan. Following risk assessments that require any remediation, the cybersecurity team then conducts a risk treatment and response process, including mitigation, remediation and risk reduction efforts. Our policies also require that Internet-accessible enterprise systems and applications must undergo a penetration test at least annually, and we engage specialized, independent third parties to conduct penetration tests and specific in-depth reviews of certain enterprise systems and applications.

companyName: Mobileye Global Inc.

ticker: MBLY


text: For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A. "Risk Factors – Unauthorized or improper disclosure of personal or other sensitive information, or security breaches and incidents, whether inadvertent or purposeful, including as the result of a cyber-attack, could result in liability and harm our reputation, each of which could adversely affect our business, financial condition, results of operations and prospects" in this Annual Report.

companyName: TaskUs, Inc.

ticker: TASK


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: We engage third party service providers including consultants and auditors in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees, management, management's committees, as well as each individual Company employee.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Financial Officer has experience supervising and managing company security and privacy departments.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: Management is responsible for day-to-day assessment and management of cybersecurity threats and risks. Nordson's Senior Director of Security and Compliance, primarily leads these efforts. The Vice President, Information Systems and Technology is responsible for oversight of Nordson's entire global IT operations, including the cybersecurity program and brings more than 25 years of experience and leadership across various information technology engineering, business and management roles, including direct oversight of strategic direction, program execution and operational excellence of technology initiatives.

companyName: NORDSON CORP

ticker: NDSN


text: Management's Role Managing Risk The Company's management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Risk Assessment, Identification and Management Processes We have implemented a cybersecurity risk management strategy to assess, identify and manage material risks from cybersecurity threats. This strategy is designed to protect our systems, data, and operations from potential cyber threats and to ensure the continuity of our business operations.

companyName: Frontdoor, Inc.

ticker: FTDR


text: There have been no recent incidents of cybersecurity breaches within the Company's information systems in the past three fiscal years. For additional information, refer to the section entitled "The Company may be adversely affected by a disruption in, or failure of, information technology systems" within "Item 1A – Risk Factors" in Part I of this Form 10-K.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: Managing cybersecurity risk and maintaining secure, reliable, and functional systems are among our highest priorities. Therefore, we have implemented tools, procedures, processes, and management mechanisms to help us achieve a robust cybersecurity environment, and a reliable cybersecurity posture.

companyName: Research Solutions, Inc.

ticker: RSSS


text: The director of cybersecurity has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity has been involved in designing and evolving the Companies' cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.

companyName: VIRGINIA ELECTRIC & POWER CO


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition. The CCO monitors best-practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive company data. The CCO continues to work with key third-party service providers to monitor and support the control environment and breach notification processes.

companyName: John Hancock Comvest Private Income Fund


text: Our information technology and internal audit teams utilize frameworks consistent with well-recognized industry cybersecurity frameworks to identify and mitigate information security risks and oversee an active cybersecurity training program.

companyName: W. P. Carey Inc.

ticker: WPC


text: Senior management works collaboratively across the organization to implement a program designed to protect our information systems from cybersecurity threats and to respond to any cybersecurity incidents in accordance with our incident response and recovery plans. A cross-functional team addresses cybersecurity threats and responds to cybersecurity incidents through communications within the team and with third-party experts to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and report such incidents to the board of directors and the Audit Committee when appropriate.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying, evaluating suitable acquisition transaction candidates and completing the merger with our target acquisition companies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: VSEE HEALTH, INC.

ticker: VSEE


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board administers this oversight function directly through our Board as a whole, as well as through various standing committees of our Board that address risks inherent in their respective areas of oversight. Our Audit Committee, a subcommittee of our Board, is responsible for the oversight of risks from cybersecurity threats. The Audit Committee receives updates at least quarterly from our Head of Information Technology regarding developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, how management is managing those risks, and, if any, material cybersecurity incidents and the impact to our business and performance.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy. See "Risk Factors Risks Related to Cybersecurity and Technology – Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations." in Part 1, Item 1A. Risk Factors of this report for a discussion of these risks. As a result, at least in part, of the steps taken by the Firm with respect to our cybersecurity program, we have not experienced a material breach to date.

companyName: KFORCE INC

ticker: KFRC


text: The Company has implemented the following processes to assess, identify, and manage material risks from cybersecurity threats: • Annual audits, by an independent third party, of the Company's cybersecurity framework under the National Institute for Standards and Technology ("NIST") cybersecurity framework; • Penetration tests conducted by a third-party; • Simulation of attacks on the Company's systems by third-parties to test the Company's systems and protections;

companyName: CARTERS INC

ticker: CRI


text: While there have been cyber incidents in the past, none of these incidents, individually or in aggregate, had a material adverse effect on our business strategy, operations, or financial conditions. Refer to "Risk factors" in Item 1A of this Form 10-K for additional information about cybersecurity-related risks.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: Our Board of Directors consider cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: AMERICAN AIRLINES, INC.


text: The Company and the broader financial services industry face an increasingly complex and evolving threat environment.


text: Our Board of Directors (the "Board") oversees our cybersecurity risk management activities. At least annually, the CISO, CIO and certain other members of the cybersecurity committee report to the Board on the state of our cybersecurity risk program and current and emerging cybersecurity risks. The Board's Audit Committee has been delegated strategic oversight of our cybersecurity risk management program and the work of the cybersecurity committee and is responsible for providing feedback regarding the cybersecurity risk program, as needed. Any cybersecurity incident deemed to have a moderate or higher business risk is also reported to the Board.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Management Strategy maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually by our Executive Management Team as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Executive Management Team to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate whether we have adequate controls in place utilizing a risk-based approach that tailors and applies best practice from various industry standard IT Management frameworks such as Information Technology Infrastructure Library (ITIL), Control Objectives for Information Technologies (COBIT), National Institute of Standards and Technology CyberSecurity Framework, and ISO/IEC 27001.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NORTHWEST BIOTHERAPEUTICS INC

ticker: NWBO


text: Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company.

companyName: Digital Turbine, Inc.

ticker: APPS


text: The Company's Chief Information Officer ("CIO") oversees the Company's information technology programs and investments. The Company's CIO has over 20 years of information technology experience, including ten years in various information technology leadership roles. Our CIO holds a Bachelor of Science in Information Technology. The Company's Chief Security Officer ("CSO") reports to the Chief Risk Officer and oversees the Company's information security programs. The CSO possesses over 20 years of Information Security and Technology experience.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: Cybersecurity Incident Response. We have an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The incident response plan indicates the vice president of support services, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, corporate controller and the board of directors are to be notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.

companyName: Knife River Corp

ticker: KNF


text: We have established an incident response process to identify, assess, and respond to cybersecurity events, if any. This process includes established roles, responsibilities and procedures to guide incident response operations, and reporting procedures for notifying members of management and the audit committee, where appropriate. We also maintain back-ups and disaster recovery plans to restore information in the event of an incident. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: We engage third parties to asses our cybersecurity measures, including information security maturity assessments, internal audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: POTBELLY CORP

ticker: PBPB


text: As a Company, we have developed key security services, including data governance, encryption, vulnerability management, systems and network monitoring, access controls, application security, threat detection, incident response, employee awareness training and assessment of our third-party service providers. We regularly test our incident response readiness and reporting through tabletop exercises, external and internal penetration testing and internal security testing so that identified risks and incidents are escalated and communicated for appropriate remediation activities that are intended to reduce risks to an acceptable level.

companyName: RADIAN GROUP INC

ticker: RDN


text: We have a formal information security program, designed to develop and maintain privacy and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information. This program is governed by a committee comprising members of senior management, including our Chief Information Officer ("CIO"), which meets regularly and reports to the Board of Directors at least annually (the "Information Security Governance Committee"). Members of the Information Security Governance Committee oversee communications with the Board of Directors regarding material cybersecurity incidents and provide the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to AMG's information security practices and procedures. The Board of Directors is also regularly provided with cybersecurity educational sessions, including perspectives from external advisors that are invited to present on current cybersecurity topics.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: SEKISUI HOUSE U.S., INC.


text: The CIO also presents at least annually to the Board an overview of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results of third-party assessments, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Our Chief Executive Officer, Assistant General Counsel and Chief Accounting Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers and outside counsel, as needed.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Cyber risk management has become a vital part of our broader ERM efforts. To manage and mitigate cyber risks, we have a dedicated information security team that has been charged with monitoring and managing cyber threats to our information systems, and the data that is stored on those systems, using our cyber risk management methodology. Our information security team is led by our SDIS and overseen by our CITO. Our cybersecurity risk management framework encompasses, among other things, ongoing systematic processes to identify, analyze, prioritize, manage, and monitor potential cyber risks to the information systems that we own or use and the cybersecurity threats to which we are exposed as a result of our reliance on third-party service providers and third-party software. Our cyber risk management methodology is comprised of the following core tasks: • Risk identification – Our internal information security team works with an MSSP and other external security partners to identify existing and new threats to our information systems. Our information security team, working in partnership with our MSSP, monitors our information systems to identify malicious and anomalous activity, uncover potential cybersecurity threats, and assess risks to information systems. • Risk analysis – Our information security team, working in partnership with relevant cybersecurity and technology experts, analyzes identified threats to determine the likelihood of the actualization of a threat and the potential business impacts, including evaluating the potential for data loss, data corruption, disruption to business operations, and financial impact. • Risk evaluation – Identified risks are evaluated to determine whether gaps in our controls or risk mitigation strategies exist that could result in material risk to the Company. If it is determined that our existing processes, strategies, or technology may be insufficient to effectively mitigate or manage an identified risk, it is escalated to our CITO and SDIS to assess and implement potential responsive or corrective actions in our processes, strategies, or technology to address the risk. • Risk mitigation – Our senior executive team, which includes our CITO, using input from our information security team and our broader information technology (or IT) department, develop and approve budgets, strategies, technology roadmaps and programs which are designed to effectively manage our cyber risks, safeguard our information resources, and reduce the likelihood or impact of cybersecurity incidents.

companyName: Schneider National, Inc.

ticker: SNDR


text: Oversight of Third-Party Service Providers We manage cybersecurity risks through our use of third-party service providers by integrating our mitigation strategies throughout various functional areas within the Company, including but not limited to the Company's business segments and information technology, engineering, infrastructure, and legal departments. These strategies include, as applicable, conducting technical assessments at the outset of any third-party service provider engagement, limiting the disclosure or transfer of information to an as-needed basis by way of technical infrastructure, and contractually requiring third parties to maintain security controls and protect our information and maintain established notification protocols in the event of any known material data breach using industry best practices.

companyName: Leafly Holdings, Inc. /DE


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Credit Income Corp.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes that is centered on three key components: • Identification of risks: We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. • Assessment of threats: We assess organization vulnerabilities and the likelihood that the risk scenarios could occur, including risk assessments of our existing systems, penetration testing, and other vulnerability analyses. This assessment also extends to critical third parties, such as contract research organizations, prior to being approved to work with the company, and includes reviews of Service Organization Control Type 2 reports. • Execute: Internal and third-party experts coordinate implementation of necessary security controls to prevent or reduce the risk of security vulnerabilities from being exposed.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Our operations rely on both on-premises and cloud-hosted IT solutions for critical business processes such as compliance, reporting, marketing, e-commerce, operations, product development, manufacturing, distribution, data management, and stakeholder communication. Recognizing the paramount importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data, and maintaining the integrity and availability of our systems. To this end, we have implemented a comprehensive cybersecurity risk management framework designed to identify, assess, mitigate, and prevent potential cybersecurity risks, aligning with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework (NIST-CSF), which outlines the core components and responsibilities necessary to sustain a robust and well-balanced cybersecurity program.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect us, including our business strategy, operational results, and financial condition.

companyName: FS Credit Real Estate Income Trust, Inc.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K, including "We, and the third parties with whom we work, rely significantly on information technology systems and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively and have a material adverse effect on our business, reputation, financial condition, and results of operations."

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, Southwest Gas undertakes the following activities: • deploys a defense-in-depth approach with security measures in place at multiple layers; • closely monitors information systems using a suite of technologies and a specialized cybersecurity team; • reviews emerging data protection laws and implements changes to our processes designed for compliance; • trains each new employee who handles individual customer data on handling and use requirements for such data; • avoids, where possible, storing sensitive customer information like social security numbers or banking information for individual customers on our information systems; • conducts regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice, and contracts (as applicable), encourages employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • runs tabletop exercises to simulate response activities to a cybersecurity incident and use the findings to improve our processes and technologies; • leverages the NIST Computer Security Incident Handling Process as a guideline to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • conducts vulnerability and penetration assessments, with associated remediation activities.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2023, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and data handling and provided targeted cybersecurity threat awareness and training to executives during 2023. The Company conducts Incident Response tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response plans and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: Onex Corp. conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The cybersecurity team of Onex Corp. reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. Onex Corp.'s cybersecurity team and Onex Corp.'s MSSP also review the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Onex Corp.'s and its affiliates' information and systems.

companyName: Onex Direct Lending BDC Fund


text: Our Board oversees cybersecurity risk as part of its overall risk oversight function. We utilize resources from AULT to act as our information technology department (the "IT Department"), which functions as our Information Security Advisory Team. The IT Department is responsible for managing our information security program and implementing cybersecurity risk management practices.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees and reviews the design and effectiveness of the Corporation's cybersecurity program and its contingency plans and provides regular reports to the Board of Directors of the Corporation. The DPM provides periodic reports to the Audit Committee, the Corporation's Chief Executive Officer, Chief Financial Officer, and other members of senior management at each of the Audit Committee meetings and in the event of a cyber incident deemed material. These reports include updates on the Corporation's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: c. The use of external service providers, where appropriate, to assess defenses, analyze threat intelligence, or otherwise assist with aspects of our security controls; d. Cybersecurity awareness training of our employees, software development teams, incident response personnel, and senior management;

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: See Item 1A. Risk Factors for additional discussion on information security risks. See also Part II – Item 7 – Risk Management for additional information on the Company's Enterprise Risk Management Framework, including further discussion of the Company's risk governance and the management of related risks.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: Our CTO's background includes more than 20 years of experience in the technology domain, with 15 years in the retail industry, leading e-commerce implementations and large scale transformation projects like adopting cybersecurity best practices. Our VP, IT has more than 30 years of experience implementing security in complex manufacturing and retail environments. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.

companyName: Childrens Place, Inc.

ticker: PLCE


text: Our information security team (with oversight from our Chief Information Security Officer ("CISO") and support from our head of information technology) helps to identify, assess, and manage the Company's cybersecurity threats and risks. Our information security team works to identify and assess risks from cybersecurity threats by monitoring and evaluating the Company's threat environment and risk profile using various methods including, for example, vulnerability scanning and monitoring and periodic testing and audits.

companyName: Akili, Inc.


text: The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. The Audit Committee receives regular updates on cybersecurity risks from our Chief Information Officer ("CIO"). The Audit Committee also regularly receives updates on efforts regarding data loss prevention, regulatory compliance, data privacy, threat and vulnerability management, cyber-crisis management, and other topics as applicable. Additionally, management provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well.

companyName: SHYFT GROUP, INC.


text: The Board of Directors (the "Board") is responsible for oversight of the Company's management of operational risks, including cybersecurity threats. The Board receives a comprehensive report at least annually from the Chief Information Officer and the CISO. The comprehensive annual report covers matters related to the Program, such as enhancements, incident reporting, performance metrics, status reports, oversight of third-party service providers, and the results of Program reviews, including exercises and response readiness assessments led by external consultants. The report also includes information about significant and emerging cybersecurity threats that may affect the Company. In addition to a comprehensive annual cybersecurity report, the Board receives periodic interim reports from the Chief Information Officer and the CISO. To the extent cybersecurity controls are related to internal controls over financial reporting, such controls are also considered in the context of Management's annual assessment of the effectiveness of internal controls over financial reporting.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to Company data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirements, and system monitoring.

companyName: ThredUp Inc.

ticker: TDUP


text: Management Level Governance Our cybersecurity efforts are led by the Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"). The CISO has primary management-level responsibility for assessing and managing our cybersecurity program. The CISO reports to the CTO, who provides regular feedback to other members of the management team on managing material risks from cybersecurity threats.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: We face cybersecurity risks, as a small company, due to the breadth of networks and systems we utilize to design, develop, produce and sell our LMR products. We also use third-party products, services and components to produce our LMR products. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to rebuild our internal systems, implement additional threat protection measures, provide modifications or replacements to our products, respond to regulatory inquiries or actions, pay damages, provide customers with incentives to maintain a business relationship with us, or take other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: BK Technologies Corp

ticker: BKTI


text: Management reviews the Company's IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; and (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and its other assets or assets of its customers or other third parties in the Company's possession or custody.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: When a cybersecurity threat or incident is identified, the Senior Vice President of Technology and the security team works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Chairs of the Innovation and Technology Committee and the Audit Committee, regarding any significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, associates and stakeholders, and continues to provide regular reports until such incidents are concluded. The above framework tracks and allows team members to monitor each incident throughout its lifecycle to ensure the Company is informed about and following cybersecurity incidents as they are mitigated and remediated. Post-incident reviews are also performed to determine if there are any additional controls that may feasibly be implemented to prevent recurrence.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: The second line of defense consists of the risk management and compliance functions, which provide oversight, guidance, and support to the first line of defense, as well as monitoring and reporting on the institution's cybersecurity posture and performance.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: Cybersecurity Incident Reporting and Management We have not identified any cybersecurity incidents that have materially affected or vulnerabilities to cybersecurity threats that are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: Members of our executive management team are responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The individuals currently serving in these roles are our President and Chief Commercial Officer and our Vice President, Finance and Chief Accounting Officer. The executive management team monitors current events in order to remain aware of current cybersecurity threats. The executive management team is informed and alerted by our information technology ("IT") consultant and our frontline personnel of any specific incidents, in addition to cybersecurity risks. Our executive management will inform our Board of Directors of cybersecurity incidents if and when they may arise. Additionally, the Board considers risks from cybersecurity threats as part of its holistic assessment of the risks facing our business.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI


text: We did not experience a material cybersecurity incident in 2023, and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors – Our operations may be subject to cyber-attacks that could have an adverse effect on our business operations."

companyName: SUPERIOR ENERGY SERVICES INC


text: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. For more information about these and other information security risks we face, see "Item 1A. Risk Factors — Strategic and Operational Risks."

companyName: GENUINE PARTS CO

ticker: GPC


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause water or wastewater system operational problems, disrupt service to our customers, compromise important data or systems or result in an unintended release of customer or other confidential information. See "Item 1A. Risk Factors—Risks Related to Cybersecurity and Technology" for additional discussion of cybersecurity risks impacting our Company.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our Board has tasked the Audit Committee with oversight of enterprise risk management, including cybersecurity risk management. Our CISO or EVP, Chief Product and Technology Officer briefs the Audit Committee on cybersecurity risks at each of the quarterly meetings of the Audit Committee. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. The Audit Committee and/or the EVP, Chief Product and Technology Officer also regularly briefs the entire Board on cybersecurity matters.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: We are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.

companyName: ARTIVION, INC.

ticker: AORT


text: We administer our cybersecurity risk management framework separately from our other risk management systems and processes, under the oversight of the audit committee of our board of directors and senior management. Strategy's management, including our CTO and CISO, provides the audit committee with regular updates on cybersecurity incidents and emerging threats. The audit committee actively engages with management on the development and implementation of cybersecurity policies and practices, offering insights and guidance. Additionally, board members with significant experience in software technology, such as Michael J. Saylor and Leslie J. Rechan, each with over 30 years of software industry experience, and Phong Le, our Chief Executive Officer, contribute their expertise to our cybersecurity risk management.

companyName: Strategy Inc

ticker: MSTR


text: We perform information technology supplier risk assessments on a periodic basis. Information technology suppliers to SS&C that access, handle, transmit, process or store personal information or other customer data on our behalf are assessed and are also subject to periodic due diligence procedures.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Notwithstanding our cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For a discussion of cybersecurity risks, see Item 1A, "Risk Factors —Risks Related to Our Operations—An information security incident, including a cybersecurity breach, or the failure, interruption, breakdown, invasion, corruption, destruction, or breach of an information technology system owned or operated by us or a third party, could adversely affect our business, results of operations or financial condition."

companyName: Kenvue Inc.

ticker: KVUE


text: Our management, represented by our Chief Financial Officer, Ward Lyke, provides leadership for implementation and maintenance of our cybersecurity risk management processes. Mr. Lyke has served as Vice President, Chief Financial Officer, and Treasurer since January 2024, and as an Executive Vice President and Officer of the Company since 1984, including as Assistant Treasurer since 2003. Mr. Lyke currently manages key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Lyke oversees the Company's managed IT solutions service provider which includes, among other services:

companyName: MAYS J W INC

ticker: MAYS


text: Through established governance structures, including our incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Risk Committee, or to the full Board, as appropriate.

companyName: Village Bank & Trust Financial Corp.


text: Cybersecurity threats have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while we are strategically focused on pursuing FDA PMA approval and have minimal commercial operations. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be effective in protecting the Company's systems and information.

companyName: United Health Products, Inc.

ticker: UEEC


text: For the year ended September 30, 2025, Adient did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect Adient's business strategy, results of operations, or financial condition. For further information about the risks associated with cybersecurity incidents, refer to the cybersecurity risk factor in Item 1A, "Risk Factors" in this Form 10-K.

companyName: Adient plc

ticker: ADNT


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external independent auditors. These assessments include a variety of activities including information security assessments, audits and independent reviews of our ISMS, control environment and operating effectiveness. For example, in 2023 and 2024, we conducted independent audits to assess our ISMS against the ISO/IEC 27001:2013 standard and received certification of compliance with the standard. We also undertake regular penetration testing of our systems. The results of significant assessments are reported to management and the Board. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: We have a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation. We leverage the National Institute of Standards and Technology Cyber Security Framework 2.0 for measuring overall readiness to respond to cyber threats and the Sarbanes-Oxley Act for assessment in internal controls. Our cybersecurity processes are integrated into our overall risk management program, and include a comprehensive cyber crisis management program that would apply if a cybersecurity related incident were to occur.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: Our third party service providers report to our Principal Financial Officer who is responsible for the management of the Cybersecurity program. The Principal Financial Officer on a regular basis reports to the Audit Committee.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We experience cybersecurity and other threats and incidents in the course of our operations. To date, we have not determined that such threats and incidents have materially and adversely affected the Company, including our business strategy, results of operations or financial condition. Furthermore, to date, we have not determined that such threats and incidents are reasonably likely to materially and adversely affect the Company, including our business strategy, results of operations or financial condition.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: The Company recognizes the critical importance of maintaining the safety and security of our systems and data amidst an ever-evolving landscape of cybersecurity threats and has adopted a process for overseeing and managing cybersecurity and related risks.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Our Audit Committee takes the lead on behalf of our Board of Directors in monitoring risk management, which includes overseeing the Company's management of its cybersecurity and data privacy. The Audit Committee meets on a quarterly basis with our Vice President of Engineering, General Counsel and Chief Financial Officer, who provide quarterly reports concerning the Company's information security and cybersecurity risks.

companyName: IEH Corp

ticker: IEHC


text: To date, Cybersecurity threats have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition.

companyName: PROCYON CORP


text: Despite ongoing cyber-attacks, such as unauthorized access, phishing, and ransomware, we have not identified any cybersecurity incidents that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations, or financial condition. Our proactive security measures, alongside those of our third -party vendors, aim to protect our information technology systems and the sensitive data they hold. To bolster our cybersecurity posture, Transcat has engaged a third -party Managed Security Services Provider ("MSSP") to enhance our defensive capabilities. This partnership includes comprehensive vulnerability scanning both internally and externally to detect potential security weaknesses before they can be exploited. Our MSSP also provides round-the-clock monitoring through a 24x7x365 Security Operations Center ("SOC"), safeguarding our digital assets ("Endpoint Detection and Response - EDR"), identities ("Identity Detection and Response - IDR"), and integrating supplemental logging sources such as firewalls and Enterprise Resource Planning systems ("Extended Detection and Response - XDR"). Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.

companyName: TRANSCAT INC

ticker: TRNS


text: As part of the ISP that is applicable to the Fund, AB also performs cyber risk assessments on the Fund's critical and material third party vendors during onboarding and periodically thereafter.

companyName: AB Private Credit Investors Corp


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and containment. The Company has other policies and procedures which directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption standards, antivirus protection, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: We have an enterprise-wide information security program designed to assess, identify, and manage the Company's information security risks and identify, evaluate, respond to and resolve information security incidents. To protect our information systems from information security incidents, we use various processes and tools to identify, prevent, detect, escalate, investigate, resolve and recover from identified vulnerabilities and threats. These include, but are not limited to, reporting, monitoring and detection tools that are widely used in the industry, and internal solutions. We have an enterprise-wide Incident Response Policy and Incident Response Procedure, which outlines the various points and detailed processes and procedures to be followed when a suspected incident is identified. The overall Incident Response Objectives are to: a. Accurately investigate and validate the incident b. Minimize damage or loss of data and services for the Company, our clients, users,employees, and other potentially affected individual data subjects, as appropriate c. Preserve and/or collect evidence pursuant to the incident in a legally sound manner e. Review evidence to determine next steps, including notifications where necessary or advisable f. Document and implement post incident actionable recommendations to prevent incident reoccurrence and improve the incident response process We assess our cybersecurity maturity and readiness utilizing the CIS (Center for Internet Security) Critical Security Controls, and measure our ongoing progress against this framework to identify areas of opportunity for improvement to our overall cybersecurity readiness.

companyName: PETMED EXPRESS INC

ticker: PETS


text: The Company has established a cybersecurity policy which requires mandatory compliance of all Company directors, officers, employees, interns, consultants, and contractors. The Company has also established cybersecurity and information security awareness training programs. Employees with access to the Company's network receive annual training on topics such as phishing, malware, and other cybersecurity risks. Training is administered and tracked through online learning modules.

companyName: STONERIDGE INC

ticker: SRI


text: Except for the Cybersecurity Incident, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may not be sufficient to cover all insured losses or all types of claims that may arise.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Our objective for managing information security and cybersecurity risk is to avoid or minimize the impacts of both internal and external threat events and other efforts to penetrate or otherwise compromise the confidentiality, integrity, or availability of our systems. We work to achieve this objective by hardening networks and systems against attack, and by diligently managing visibility and monitoring controls within our data and communications environment to recognize events and respond appropriately.

companyName: VICOR CORP

ticker: VICR


text: The Nominating and Corporate Governance Committee, which is comprised entirely of independent directors, reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile both at its regularly scheduled meetings and, if appropriate, in real time. Cybersecurity Leadership, members of the cybersecurity team, or other advisors, as requested by the Nominating and Corporate Governance Committee, report at least quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Nominating and Corporate Governance Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Reporting to the Nominating and Corporate Governance Committee is multi-format and includes both live presentations and memoranda. The Board believes that this regular cadence of reporting helps to provide the Nominating and Corporate Governance Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Nominating and Corporate Governance Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities, including our cybersecurity and business interruption insurance coverages, and the effectiveness of the Company's escalation procedures. Based on these management reports, the Nominating and Corporate Governance Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated by management on as needed basis to the Nominating and Corporate Governance Committee. The Nominating and Corporate Governance Committee may also escalate such issues to the full Board at any time.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks, including as a result of previously identified cybersecurity incidents that have, or are reasonably likely to have, materially affected us, including our business strategy, results of operations, or financial condition. We have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks and we acknowledge that cybersecurity risks are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: GENESIS ENERGY LP

ticker: GEL


text: Our Senior Director of Information Technology coordinates with our Chief Financial Officer ("CFO") and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our Senior Director of Information Technology has over fifteen years of experience in information technology, including over five years in cybersecurity and information security. Our Senior Director of Information Technology is also supported by a cross-functional security incident response team, which is responsible for identifying, reporting, investigating, documenting, and mitigating cybersecurity incidents pursuant to our incident response plan and policy.

companyName: MBX Biosciences, Inc.

ticker: MBX


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, including our cybersecurity safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Gentherm Inc

ticker: THRM


text: We assess the security of our networks, websites, and systems with automated vulnerability detection services from a provider that is validated by the NIST, based on the Security Content Automation Protocol ("SCAP") standard. We perform an annual review of our efforts to manage risk with controls that align with and map to key compliance frameworks, such as NIST and the ISO 27000 series of standards. We perform quarterly IT risk assessments that include cybersecurity risk assessments focused on action plans developed through annual reviews. We also respond to risks as they are discovered real-time. We are guided by an Information Security Incident Response Policy and corresponding Information Security Incident Response Procedure we implement when handling IT security incidents.

companyName: ALAMO GROUP INC

ticker: ALG


text: Voya's Board committees include the Risk Committee, which provides support to the Board in its oversight of information technology, including cybersecurity risk. To assist the Board in fulfilling its oversight function, the Risk Committee is responsible for overseeing cybersecurity risk and collaborates with the Audit Committee on the related disclosures. The Risk Committee receives regular updates from the CISO on cybersecurity-related matters and reports regularly to the full Board.

companyName: Voya Financial, Inc.

ticker: VOYA


text: While cybersecurity threats as a result of any previous cybersecurity incidents have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs and/or expose us to litigation.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Furthermore, our cybersecurity program is periodically reviewed by senior management members and adjusted as needed to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge, and regulations change.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: A process for assessing, identifying, and managing cybersecurity related risks is integrated into our overall enterprise risk management ("ERM") process. Cybersecurity related risks are included in the risk universe that the ERM process participants evaluate to assess top risks to the Company on an annual basis. The Audit Committee of the Board oversees the ERM annual risk assessment. Furthermore, as a digital innovation and transformation company, we are committed to our ever-evolving cyber protocols that safeguard our people, clients, and data. Every year, we assess our approach to information and physical security, risk management, incident response, business continuity management, and personal data privacy and protection.

companyName: ASGN Inc

ticker: ASGN


text: We assess our cybersecurity risk management program at least annually and regularly review our cyber incident response plan and conduct cybersecurity tabletop exercises. Our processes and policies also include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats. We also partner with industry leading third parties for regular security audits. These audits ensure we view cybersecurity with a holistic perspective.

companyName: Invitation Homes Inc.

ticker: INVH


text: Board's Oversight Role. The Audit Committee reviews and assesses the Company's risk management program and cybersecurity activities and strategy to help align with the Company's business objectives and compliance with legal and regulatory standards. These updates include reviews of new or evolving cybersecurity threats, the Company's cybersecurity measures, the results of recent third-party security audits, and assessments and oversight of any recent cybersecurity events with certain characteristics that may have occurred. This oversight role includes evaluating the effectiveness of policies and procedures designed to protect Company assets and sensitive customer information from cyber threats. The Chair of the Audit Committee regularly reports on the Audit Committee's oversight activities related to enterprise risk management and cybersecurity to the full Board of Directors. The Information Security Coordinator promptly notifies the Chair of the Audit Committee of any security events reviewed by the SIRT, the SIRT's determination of whether a security event is reportable on Form 8-K pursuant to the SEC Cyber Rule and the factors underlying that determination. If the SIRT determines that a cybersecurity incident is likely material and therefore reportable on Form 8-K, a draft of the Form 8-K will be provided to the Audit Committee for review and comment prior to the Company filing the Form 8-K within the deadline specified by the SEC Cyber Rule. The Audit Committee's active engagement with and oversight of the Company's cybersecurity program helps foster a culture of security awareness throughout the Company.

companyName: EVgo Inc.

ticker: EVGO


text: Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the Board as a whole oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The full Board receives at least annual reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.

companyName: enCore Energy Corp.

ticker: EU


text: The Utilities cybersecurity program adopts security measures designed to protect the confidentiality, integrity, and availability of information technology systems, network infrastructure and other assets. The Utilities' security measures, such as awareness and training, monitoring, etc. are designed to prevent, detect, and minimize the effects of a cybersecurity incident. These measures are periodically evaluated and audited against the NIST CSF by internal audit and independent third-party cybersecurity specialists.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: We have an Incident Management Policy ("IMP") and Incident Response Plan ("IRP") which helps enable us to quickly detect, respond to, and recover from third-party malicious attacks and potential security incidents. This plan includes formal steps to review incidents and implement improvements, including steps to involve the CISO, CIO and CTO as appropriate.

companyName: CANTALOUPE, INC.

ticker: CTLP