text: The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents. We integrate these processes into the Company's overall risk management program and, through the Company's Cybersecurity Incident Response Plan, we document the intended processes and the roles and responsibilities of teammates involved in assessing, identifying and managing material risks from cybersecurity threats. Periodically, the Company engages third parties to assist in the assessment and ongoing development of cybersecurity processes.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored and escalated appropriately, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"), who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Our CISO has more than 25 years of experience in various roles related to information security and technology, including 14 years as CISO and other leading cyber security roles in the fintech industry. Management, the CISO and our cybersecurity team, periodically update the Risk Committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.

companyName: Payoneer Global Inc.

ticker: PAYO

secItem: Item 1C


text: We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems and critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. Our most important information system is our satellite network and related ground systems that carry our customers' traffic on our network. We also maintain critical internal computer networks, as well as third-party hosted services, communications systems, hardware and software.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.

companyName: Track Group, Inc.

ticker: TRCK


text: Our CIO reports at least annually to the Audit Committee and such reporting will include an overall assessment of our compliance with our cybersecurity policies and procedures as well as topics that may include risk assessments, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures. In the event of a cybersecurity incident, the CIO reports the incident to the executive leadership team. If the cybersecurity incident is determined to be material the executive leadership team will report the incident to the Audit Committee or Board of Directors as appropriate.

companyName: Verastem, Inc.

ticker: VSTM


text: His background includes extensive experience achieving bank and government-level compliant security practices in high-performance technology companies. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, communicates cyber security threats, remediates known risks, and oversees our employee training program.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents. Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security. The primary responsibility of the management team with respect to cybersecurity risk is managing our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants, and working with all divisional, manufacturing, and functional teams on cybersecurity issues. The management team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by monthly and quarterly briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment. In the event a cybersecurity incident rise to the level of a corporate crisis, the management team along with the Security Incident Response Team would engage the Company Board.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Should cybersecurity issues arise throughout the quarter, management would determine whether a cybersecurity incident was material and decide on appropriate reporting and mitigation measures. Following this determination, management would promptly schedule a meeting with the Audit Committee.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Amesite Inc.

ticker: AMST


text: The CISO is responsible for managing our information security program. Our CISO has over 20 years of information technology experience and over 15 years of information security experience; is a Certified Information Systems Security Professional, Certified Information Systems Auditor, Certified Information Systems Manager, and Check Point Certified Engineer; and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: our second line of defense includes the following: • Chief Technology Risk Officer: The CTRO provides independent oversight of our cybersecurity programs and challenges of first line risk management and risk-taking activities pertaining to cybersecurity and technology risk. Capital One Financial Corporation (COF)

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks arising from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic assessments to identify such cybersecurity threats.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process. Prospect Capital Management, also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer and the Chief Technology Officer. The Cyber Incident Response team meets bi-weekly to review incidents that have occurred. The Chief Technology Officer reviews weekly reports which contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: Ashford Inc.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration – We work with government, customer, industry and/or supplier partners, such as the National Defense Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain. • Third Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including spear phishing and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – We provide training and other resources to our suppliers to support cybersecurity resiliency in our supply chain. We also require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken, and continue to take, to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurance that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially affect us. As described in Item 1A – "Risk Factors", any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks, or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is integrated into the Company's overall risk management processes, which includes an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).

companyName: NETSTREIT Corp.

ticker: NTST


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. See "Risks Related to Technology" included as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which are incorporated by reference herein.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: We engage third parties and auditors to assess our cybersecurity program, including the use of select penetration testing and threat intelligence services, and to assist us in adopting and implementing industry-standard practices to improve our cybersecurity program. We have also retained third parties for cybersecurity incident response engagement in the event that a cybersecurity threat or incident requires capabilities beyond those of our own cybersecurity program. In addition, we have a third-party managed security operations center that provides 24/7 monitoring and alerting, threat intelligence, and posture recommendations. We are members of the Retail and Hospitality Information Sharing and Analysis Center, with more than 250 member companies from the retail, hospitality, and travel industries, which enables us to benchmark our cybersecurity risks, identify and adopt industry-standard practices for our cybersecurity program, subscribe to threat intelligence alerts, and contribute to the collective defense of our industries.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program), which includes policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: The Company has integrated cybersecurity risk management into our overall risk assessment framework to identify, evaluate and manage cybersecurity threats and risks. Our CFO works closely with our IT service provider and internal auditors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: City Office REIT, Inc.


text: We have developed a procedure by which the board of directors and management are informed about relevant cybersecurity risks, allowing for effective cybersecurity oversight and the ability of the Company to monitor, prevent, detect, mitigate and remediate cybersecurity incidents. The results of our evaluations and the feedback from its engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: Shimmick Corp

ticker: SHIM


text: Our CISO, who reports to our CIO, joined the Company in 2021 after working with the Company as a third-party consultant since 2019. During a nearly two-decade tenure at a leading professional services firm, he worked with clients on managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs and initiatives addressing emerging cybersecurity threats. Our CISO has significant prior cybersecurity experience, including experience protecting company, customer and associate data across a diverse set of industries. He holds a Bachelor of Science degree in Information Systems and has achieved several relevant certifications, including Certified Information Security Manager, Certified Information Systems Security Professional, and Certified Information Privacy Professional. Our CISO leads a team of over 500 associates focused on cybersecurity.

companyName: HOME DEPOT, INC.

ticker: HD


text: The Privacy and Security Subcommittee meets periodically, and receives regular reports from our Vice President, Cybersecurity and, as appropriate, other members of the Information Security Team concerning any significant cybersecurity threats and risk and the processes we have implemented to address them. The Privacy and Security Subcommittee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, generally. The Privacy and Security Subcommittee provides regular reports to the Nominating and Corporate Governance Committee of significant matters related to the Privacy and Security Subcommittee's responsibilities, and the Nominating and Corporate Governance Committee together with the VP, Cybersecurity in turn provide regular reports to our Board of Directors on such significant matters.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: We also maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats. We also have a process in place to oversee and vet our third party resources, including, for critical vendors and as appropriate, through reviews of Service Organization Control Type 2 reports.

companyName: Prime Medicine, Inc.

ticker: PRME


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Director of Information Technology and/or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: scPharmaceuticals Inc.


text: We employ an experienced team of cybersecurity professionals with a variety of backgrounds. We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including: SOC 1, SOC 2 Type II, ISO 27001, CSA STAR Level 2, PCI-DSS and others.

companyName: FAIR ISAAC CORP

ticker: FICO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and cybersecurity consultants that provide threat intelligence, managed cybersecurity, forensic, and penetration testing services.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Responsibility Assignment • The Company's Vice President - Planning and Communications (VP P&C)) assumes an oversight role in overseeing the cybersecurity risk management program. The VP P&C collaborates with the Company's leadership team and IT Service Team on the matters of cybersecurity across the Company. • Cybersecurity risks fall within the purview of the Company's Audit Committee and, ultimately, the Board of Directors. Regular oversight and reviews occur at established intervals. The Audit Committee engages in discussions with the COO and Company management at least once a year, covering various aspects of cybersecurity risk management, including recent developments, evolving standards, vulnerability assessments, and the threat environment.

companyName: YIELD10 BIOSCIENCE, INC.


text: During the fiscal year ended December 31, 2023, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2023 Annual Report.

companyName: US BANCORP \DE\

ticker: USB


text: Our security team, including our Governance Risk and Compliance lead (GRC), CISO & CIO, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has 25 years experience as a technology leader, with extensive experience within the cybersecurity ecosystem and risk management. He has been certified as a CISO by the Israeli Technion Institute. Our CIO has 15 years experience as a technology leader with extensive cybersecurity experience. He is also CRISC (Certified in Risk and Information Systems Control) certified. Our security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Teads Holding Co.

ticker: TEAD


text: Managing Material Risks & Integrated Enterprise Risk Management We are working to strategically integrate cybersecurity risk management into our broader enterprise risk management program to promote a company-wide culture of cybersecurity risk management. Our enterprise risk management project team is working closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs while building out a framework to monitor those risks and integrate objectives into our broader strategic plan.

companyName: Array Technologies, Inc.

ticker: ARRY


text: PMI relies heavily on the availability, reliability, and security of our information systems, networks, data, and intellectual property to, among other things, help manage our business processes and operations, collect and interpret data, and communicate internally and externally with employees, suppliers, consumers and customers, and business partners. We have a cross-functional cybersecurity risk program developed using standard industry practices, which monitors and manages cybersecurity threats to our business and information systems. We invest in administrative, technical, and physical safeguards, including continuity planning, to enhance resilience on our core processes, to maintain information security protections of our data and to safeguard the privacy of consumers, customers, employees and business partners. As of the date of this Form 10-K, cybersecurity threats have not materially affected our business, financial condition, or operating results.

companyName: Philip Morris International Inc.

ticker: PM


text: Risk Management and Strategy Disclosure We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: TRANS LUX Corp


text: Managing Material Risks & Integrated Risk Management In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive data on our networks and systems, including Company and third-party intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers and customers may be vulnerable to a cyber-attack.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: It's possible that a cyber-attack at a third-party service provider may have a material financial, operational or reputational impact to the Company. The Company and its business units will continuously monitor these risks associated with its service providers.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: The CSP is presented by the CSO to the Risk Committee annually for approval in conjunction with an annual cybersecurity briefing. This briefing provides an overall assessment of the effectiveness of the CSP and an outlook for the upcoming year. In addition to the annual cybersecurity briefing, the CSO provides updates on cybersecurity to the Risk Committee at each of its meetings. The Audit Committee and Board also receive regular cybersecurity updates as part of the reporting provided by the Technology/Cyber Oversight Committee, a management committee chaired by the CEO which provides executive oversight, guidance and transparency to key transformative initiatives designed to enhance our technology stability, cyber defenses and risk management capabilities. Further, to ensure the Board maintains the appropriate knowledge for providing effective oversight, it is provided with relevant cybersecurity training on an annual basis, with any additional training provided as requested.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Incident Identification and Response We have implemented a monitoring and detection system, with oversight from our Vice President – IT to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have a formal incident response plan designed to provide for immediate action to contain the incident, mitigate the impact and restore normal operations efficiently.

companyName: Antero Midstream Corp

ticker: AM


text: Additionally, we engage third-parties to conduct independent assessments of our cybersecurity posture that evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.

companyName: NEWMARKET CORP

ticker: NEU


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: As part of the Company's incident response and notification plan, the Senior Director of IT has a process to assess potential cybersecurity incidents through a cybersecurity incident decision matrix. The Senior Director of IT escalates cybersecurity incidents to our Cybersecurity Response Committee, which consists of key members of executive management. The Cybersecurity Response Committee, informed by information and recommendations from the Senior Director of IT, determines appropriate actions and responses, as needed.

companyName: AVADEL PHARMACEUTICALS PLC

ticker: AVDL


text: Our CISO leads our cybersecurity program, holds a master's degree in computer and network forensics and has over twenty years of relevant experience, including cybersecurity and enterprise security leadership roles for large global organizations and within the U.S. government. Our CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Role of Management TPL's cybersecurity risk is managed utilizing a multi-tiered approach by the Company's Director of Information Technology. In addition to the Director of Information Technology, the Company also engages the services of a third party chief information security officer ("CISO"). The qualifications of the Director of Information Technology include over 30 years of IT management, cybersecurity, and information governance experience. The CISO, who reports to the Director of Information Technology, has 21 years of cybersecurity, IT management, and infrastructure consulting experience and is a certified CISO. The Director of Information Technology is regularly informed about the latest developments in cybersecurity, including potential threats, vulnerabilities, and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Texas Pacific Land Corp

ticker: TPL


text: The Company's Board of Directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees the guidelines and policies governing the process by which management assesses and manages our exposure to risk, including material risks from cybersecurity threats. The Audit Committee receives regular updates from management, including our CIO, regarding our cybersecurity risk management program, including cybersecurity risks, threats, incidents, and mitigation strategies.

companyName: Xperi Inc.

ticker: XPER


text: Our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity threat operation that endeavors to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Collaboration: We have established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers to identify and assess cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments. • Third-Party Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks with respect to third parties, including third parties who provide solutions we rely upon for our security measures. This includes contractually obligating third-party service providers with access to our systems or processing sensitive data on our behalf to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected security breach that may affect BlackLine. • Education: Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity. We provide training upon onboarding, and annually thereafter, for all personnel regarding cybersecurity threats, with additional role-based security training as applicable. We also provide periodic cybersecurity newsletters and updates to all employees, have a phishing awareness program that includes monthly simulations, and periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Incident Response Planning: We have established and maintain an incident response plan that addresses our response to suspected cybersecurity incidents and is tested periodically. • Communication and Coordination: We utilize a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from the information security, technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Audit Committee of the Board (the "Audit Committee") and Technology and Cybersecurity Committee of the Board (the "Technology and Cybersecurity Committee") regarding cybersecurity threats and incidents. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our risk management function and Chief Information Security Officer ("CISO"). In February 2024, the Board formed a standing Technology and Cybersecurity Committee, which is comprised of independent members of the Board and assists the Board in fulfilling its oversight responsibilities with respect to risks relating to our information security, data privacy and disaster recovery capabilities.

companyName: BLACKLINE, INC.

ticker: BL


text: To protect our information systems from cybersecurity threats, we, among other things: (i) conduct regular reviews of information systems security programs and policies, (ii) perform penetration testing using external third party tools and techniques to test security controls, (iii) provide employee training, (iv) monitor emerging trends, laws, and regulations related to data protection and information security, and (v) use various security tools that help monitor, prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, monitoring and detection tools managed by external experts and internal reporting.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: Using a risk-based prioritization approach, the IT cybersecurity leadership team and the Security Committees focus on securing our high value assets, updating our cybersecurity detection and prevention capabilities to identify new threats, and improving compliance processes to protect the Company's operations and data. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: We involve our IT team when negotiating contracts that could increase our cybersecurity risk exposure, so that the team is aware of the specific risks related to a given vendor and can provide feedback and advice on the contractual provisions necessary to prevent a cybersecurity incident, or in the event an incident does occur, to ensure that the Company has the necessary rights to act quickly to protect team members, guests, and our business and mitigate potential damage. We are continuously improving our processes and contract positions to reflect evolving risks and market practices.

companyName: Portillo's Inc.

ticker: PTLO


text: Incident Reporting and Management During the years ended December 31, 2022 and 2023, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: Our board of directors, together with the audit committee of our board of directors, oversees our cybersecurity risk management program. In addition, the audit committee is responsible for reviewing with management the effectiveness of our internal control structure and procedures for financial reporting systems, including, among other things, our internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: STAG Industrial, Inc.

ticker: STAG


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: The information security program is under the responsibility of the Chief Information Security Officer ("CISO"), while governance and oversight is provided by the Technology Committee as set forth in the Technology Committee Charter. The CISO is responsible for assessing and managing risk from cybersecurity threats, as well as the strategy, execution and administration of the program, and reports directly to the Chief Information Officer ("CIO"), while also maintaining reporting lines to the Technology Committee, its chair and the full board of directors.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: After an incident has been contained our processes shift emphasis to the continuity of business operations, and if necessary, restoration of services and the recovery of any affected business systems and data. Board oversight of cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: JFI's Board Oversight of Risks from Cybersecurity Threats: JFI's Board approved both the Company's initial JFI Information Security Policy and the JFI Privacy Policy. The Finance and Risk Committee of the JFI Board assists the Board with oversight of the Company's risk framework and its effectiveness. The Finance and Risk Committee regularly reviews top risks identified by management, the Company's risk appetite, and financial and non-financial risks, including information security and cybersecurity. The committee also reviews activity reports on the status of our cybersecurity program, including material policy changes, breaches, and remediation actions. At least annually, and more often as needed, the committee meets with our Chief Information Security Officer ("CISO") in a dedicated session to review and discuss in-depth cybersecurity risks facing the Company.

companyName: Jackson Financial Inc.

ticker: JXN


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission, to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: Management and Strategy We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: RemSleep Holdings Inc.

ticker: RMSL


text: The Audit Committee receives formal annual reports from management regarding cybersecurity risks. In addition, management updates the Board and Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our cybersecurity efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: The Companies utilize an organization structure known as a converged security model that brings together cybersecurity, physical security and threat intelligence within one department led by the chief security officer. The chief security officer joined Dominion Energy in this role in 2018 and has an extensive background in security having retired from the Federal Bureau of Investigation after a more than 20-year career focused on criminal, counter-terrorism, counter-intelligence and cyber investigations. The chief security officer belongs to the Federal Bureau of Investigation's Domestic Security Alliance Council, the Department of Homeland Security's Classified Intelligence Forum and is a member of the national Government/Business Executive Forum. In addition to serving on multiple university advisory boards, the chief security officer also serves on the Commonwealth of Virginia's Informational Technology Advisory Council.

companyName: VIRGINIA ELECTRIC & POWER CO


text: The Audit Committee of the Board of Directors has responsibility to oversee management's strategy to address risks from cybersecurity threats. The Audit Committee periodically reviews with management the Company's policies, controls, and procedures used to identify, mitigate, and manage cybersecurity risks. To accomplish this objective, we have established processes for reporting cybersecurity risks to the Audit Committee of the Board of Directors on a quarterly basis. This report, which is prepared by our Senior Vice President and Chief Technology Officer, includes performance as against key performance indicators (KPIs) and service level objectives specifically defined to measure the effectiveness of our cybersecurity controls and risk management efforts, current threat landscape, and strategy. In addition, on an annual basis the Company's Senior Vice President and Chief Technology Officer presents to the Audit Committee on cybersecurity matters, including material changes to the Company's information systems, policies and controls, the results of penetration and other testing and findings from any third-party reviews. Our Audit Committee is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy to address risks from cybersecurity threats and the evolving threat landscape. The Board of Directors also is appraised of cybersecurity risks as part of its review of management's annual enterprise risk management assessment.

companyName: AGNC Investment Corp.

ticker: AGNC


text: We are aware of risks associated with our use of third-party service providers, including those who have access to our systems, data, or facilities. We have implemented processes to help manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information as part of our selection and onboarding process. We also conduct ongoing monitoring in the form of periodic reviews conducted by our security team based on the business criticality of the third-party service.

companyName: Bakkt, Inc.

ticker: BKKT


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: The Board of Directors is responsible for oversight of the Company's cybersecurity risk. In fulfilling this role, the Board receives updates from the Chief Executive Officer, who, with the assistance of external legal and accounting professionals, monitors any potential cybersecurity matters and reports to the Board as necessary.

companyName: CANNABIS SUISSE CORP.

ticker: CSUI


text: Our CISO, who heads our CDT team and is accountable for the Company's cybersecurity risk management program, joined the Company's information systems organization in 2016, is a Certified Information Systems Security Professional and is certified in risk and information systems control. Previously, our CISO served in both leadership and operational positions as a cybersecurity professional in the U.S. government and was a cybersecurity consultant, providing a wide range of cybersecurity services to various U.S. government agencies and departments. Our DTI organization is led by, and our CISO is overseen by, our CIO, who has held roles of increasing responsibility within our information systems organization since 2001 and has developed his knowledge and skills in the cybersecurity area over the course of his career in information systems. Our inaugural Executive Vice President and Chief Technology Officer (CTO), effective as of the end of 2023, oversees our CIO. Prior to the establishment of the CTO role, our CIO was overseen by our Executive Vice President and Chief Financial Officer.

companyName: AMGEN INC

ticker: AMGN


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including the business strategy, results of operations or financial condition, and management does not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, and despite security measures taken, it may not be possible to anticipate, prevent, and stop future cybersecurity incidents, including attacks on information systems and data or those of relevant business partners. Additional information on cybersecurity risks identified is discussed in Item 1A of Part I, "Risk Factors", which should be read in conjunction with this Item 1C. Cybersecurity.

companyName: VALVOLINE INC

ticker: VVV


text: Cybersecurity is a risk area with oversight at the highest levels of the organization, including the Executive and Board Level. The overall operational program is led by the Cybersecurity Strategy Council, a cross-functional team of executives and subject matter experts, led by our Chief Product Security Officer, Chief Information Security Officer and Chief Compliance Officer. The Cybersecurity Strategy Council oversees a "Three Lines Model" of Operations, Risk Monitoring and Oversight, and Audit, to effectively address cybersecurity, risk management, and control. All Cybersecurity, Risk, and Internal Audit functions report to the PTC Executive Leadership Team.

companyName: PTC INC.

ticker: PTC


text: Our Operational Risk Management group provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Significant disruptions of information technology systems, computer system failures or cybersecurity incidents could adversely affect our business, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: The CISO, who reports to the Chief Technology Officer ("CTO"), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company's global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.

companyName: HERSHEY CO

ticker: HSY


text: The cybersecurity program is aligned with our enterprise risk framework. Members of our cybersecurity, enterprise risk management, finance and legal teams collaboratively assess the degree of risk to our business and operations from cybersecurity threats and incidents to develop incident response plans and risk mitigation practices. Risk is assessed across the potential technological, operational, financial, legal, regulatory and reputational impacts to our company, including the materiality of cybersecurity incidents pursuant to SEC disclosure rules.

companyName: Trade Desk, Inc.

ticker: TTD


text: Cybersecurity risk management is an integral part of our overall enterprise risk management system. We have a cross-departmental approach to identifying, assessing, and managing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board and its Risk Committee and Audit Committee (respectively, the "Risk Committee" and the "Audit Committee"), as well as senior management in, among other areas, the information security, information technology, operations, and risk management (including enterprise and operational risk) areas, devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and to identify and respond to cybersecurity threats and incidents in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, identification, and remediation. Our information technology and information security areas review enterprise risk management-level cybersecurity risks continually, and key cybersecurity risks are incorporated into the Company's Enterprise Risk Management Framework that supports its Risk Appetite Statement. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. On an annual basis, the Board approves the Company's Information Security Policy and Program which provides a layered approach to cybersecurity, and includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information in accordance with applicable law.

companyName: SouthState Bank Corp

ticker: SSB


text: Security audits and assessments - We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, and assessments. We regularly engage appropriately qualified independent third parties to assess our cybersecurity program, including cybersecurity maturity assessments, and independent review of our security control environment and operating effectiveness.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our entire Board is responsible for the oversight of risks from cybersecurity threats. At least twice annually, the entire Board receives an overview from management of our cybersecurity progress and effectiveness, covering topics such as current cybersecurity landscape and emerging threats, data security posture, results from third-party assessments, status of ongoing initiatives and strategies, and material cybersecurity threat risks or, if any, incidents and developments. In these sessions, the Board receives materials and discusses such matters with our Chief Information Officer. The Board also receives annual training on cybersecurity. In addition, we have formed an executive level steering committee (including the CEO, CFO, Group Presidents, General Counsel, VP, Human Resources, Controller/Chief Accounting Officer, and Chief Information Officer) that provides oversight and routinely discusses cybersecurity matters.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for unauthorized access to our information technology systems and identify potential security threats through various automated detection solutions. To protect the security of our information infrastructure and protect our systems and information from unauthorized access, we draw on the knowledge and insights of an external information technology consultant who acts as our primary IT administrator and employ an array of third-party tools and technologies.

companyName: FEMASYS INC

ticker: FEMY


text: See Item 1A—"Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: Oversight of Third-Party cybersecurity risk Engaging/ outsourcing Risk management Personnel Monitoring system/ procedures for cybersecurity incidents Reporting to Board of Directors regarding cybersecurity risks and incidents

companyName: FingerMotion, Inc.

ticker: FNGR


text: We have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an annual internal review process and are approved by appropriate members of management.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Our processes also include assessing cybersecurity risks associated with our use of third-party services providers in the normal course of business use. We assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems.

companyName: Ocugen, Inc.

ticker: OCGN


text: Our overall cybersecurity strategy is to: • Cultivate a security-embedded organization and culture within the Company • Extend security from technology throughout the Company's organization, practices and processes (we call this our cybersecurity mesh) • Evolve our cyber resiliency.

companyName: Sylvamo Corp

ticker: SLVM


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process includes a review by our external partners, as appropriate.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: system protection mechanisms such as access procedures, antivirus programs, endpoint detection & response, maintaining a firewall and antispam, anti-phishing and email filtering processes;

companyName: DORIAN LPG LTD.

ticker: LPG


text: Our vendor management program is designed to ensure that our vendors meet our cybersecurity requirements and manage our third-party risks. This includes conducting periodic risk assessments of critical vendors, requiring vendors to implement appropriate cybersecurity controls, and monitoring vendor compliance with our cybersecurity requirements.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: The Corporation's Board receives information and updates periodically with respect to the effectiveness of Dow's cybersecurity and information security framework, data privacy and risk management, which includes that of the Corporation. The Board also receives updates on material incidents relating to information systems security, including cybersecurity incidents.

companyName: UNION CARBIDE CORP /NEW/


text: Our management, Chief Information Security Officer ("CISO"), information security team, and legal team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Our CISO and dedicated information security personnel maintain certain cybersecurity-related certifications and are experienced information systems security professionals and information security managers with many years of experience. In particular, our CISO maintains the following certifications: Certified Information Systems Auditor from the Information System Audit and Control Association and Certified Information Systems Security Professional from ISC2. Our management, CISO, and information security team provide updates on at least a quarterly basis to our audit and risk committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and provide cybersecurity reports on at least a quarterly basis that cover, among other topics, third-party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to such regular updates, and as part of our incident response processes, our CISO also provides updates on certain cybersecurity threats and incidents to the audit and risk committee and, as necessary, to the full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.

companyName: Remitly Global, Inc.

ticker: RELY


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: Company maintains a governance structure to address cybersecurity risk, which involves a dedicated Information Security Team (the "Information Security Team"), an Information Security Governance Board (the "Information Security Governance Board"), the Audit Committee of the Board and the Board.

companyName: Inspired Entertainment, Inc.

ticker: INSE


text: As a leading global, diversified animal health and mineral nutrition company, we are increasingly reliant on information technology systems and infrastructure to support critical operations and manage our business effectively. These systems process, transmit, and store electronic information, including customer, employee, and company data. This reliance exposes us to data security breaches and cybersecurity attacks. For more information on these risks, see "Item 1A. Risk Factors — Risk Factors Relating to Our Business — We may be subject to information technology system failures, network disruptions, and breaches in data security."

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Coordinating Incident Response or Crisis Management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Management informs the Audit Committee of material aspects of our cybersecurity program on a quarterly basis. This includes informing the committee on key strategic and operational goals, risk mitigation efforts, performance metrics, and descriptions and notification of emerging or existing risks as well as incidents impacting us.

companyName: FIVE BELOW, INC

ticker: FIVE


text: We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete a monthly computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users to identify information security threats and what actions should be taken. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such an incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section Governance

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and to protect the confidentiality, integrity, and availability of our and our client's data and information assets. As such, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Intapp, Inc.

ticker: INTA


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. We have an established incident response team (IRT) comprised of cross-functional leaders from Finance, Human Resources, Legal, Security and IT groups, to identify, assess and address cyber incidents. The IRT coordinates closely with the risk management team on cybersecurity risks and threats facing the Company. The Company conducts regular exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

companyName: V2X, Inc.

ticker: VVX


text: Axcelis implements an enterprise risk management ("ERM") process in which management annually identifies and reviews the principal risks to which the Company's business is subject, rating each risk in terms of likelihood of occurrence and severity of impact. Risks that have either a high likelihood or a high potential impact on our business are assessed quarterly with respect to the trend (an increasing or decreasing risk) and whether additional mitigation actions are needed. These quarterly risk assessments are shared with our Board of Directors, with the Audit Committee reviewing any changes in risk identification or ranking on an annual basis.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: Material Cybersecurity Risks, Threats, and Incidents While prior compromises of our security have not had, individually or in the aggregate, a material impact on our operations and/or financial condition, the Company expects risks from cybersecurity threats, including, but not limited to, security breaches, viruses, malware, ransom attacks, other cyber-attacks, or other similar threats, to continue as events of this nature are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: ACUITY INC. (DE)

ticker: AYI


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified by the Company's senior management team. Also, IT consultants work with management to follow the National Institute of Standards and Technology framework for cybersecurity to mitigate cybersecurity threats that are more likely to lead to a material impact on our business.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Eric Gauthier. With over 20 years of experience in the field of cybersecurity, Mr. Gauthier brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: SideChannel, Inc.

ticker: SDCH


text: We are also focused on building and maintaining relationships with the appropriate government and law enforcement agencies and with other businesses, industry groups and cybersecurity services to better understand the cybersecurity risks in our environment, enhance our defenses and improve our resiliency against cybersecurity threats.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see our Risk Factors.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: Many of our key IT systems are "software as a service" solutions provided by third parties with extensive experience and knowledge in addressing cybersecurity risks involving those systems and have their own robust system of controls regarding their software products, which we monitor on a recurring basis through review of independent reports on their systems of internal controls provided to us. Such IT systems include our primary accounting, financial reporting, payroll and employee benefits, document storage, email and video communication, employee expense reporting and our internal IT ticketing and asset control systems. Our internal IT team holds regular weekly meetings to discuss cybersecurity-related items such as (i) operating and application system patching, (ii) phishing attempts, (iii) malware, (iv) non-compliant devices, (v) third-party secure scorecard results, and (vi) alerts provided through our Security Operations Center.

companyName: FTC Solar, Inc.

ticker: FTCI


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor do we believe they are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.

companyName: Bark, Inc.

ticker: BARK


text: We have processes and controls that oversee, identify and manage cybersecurity risks with respect to our external service providers, including cybersecurity service providers. For example, we review and seek to negotiate terms and conditions in our legal agreements to provide for the adequate protection of confidential information and the Company's networks and systems and compliance with any applicable cybersecurity requirements, including with respect to any information exchanged. We also review the security controls of hosted solutions in an effort to ensure protection is commensurate with our security requirements. We periodically revalidate those cybersecurity control reviews commensurate with the risk identified. Further, we utilize an external security assessment service to produce security ratings that include detailed descriptions of deficiencies affecting the rating. We seek to respond accordingly to those deficiencies to the extent practicable. Lastly, as appropriate and when feasible, we may visit our service providers' facilities to observe security practices and physical security controls.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Collab Z Inc.

ticker: CLBZ


text: We have specialist security teams available 24/7 located in key locations to respond to security incidents should they occur. We maintain cyber insurance to further reduce the consequences of certain types of incidents, and we disclose material incidents to relevant regulatory bodies. We have third-party providers who provide real-time and proactive threat and intelligence and retainer services that assist in forensics and incident support alongside retained legal counsel services.

companyName: Flutter Entertainment plc

ticker: FLUT


text: The Partnership faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Partnership has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Partnership's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors – Risks Related to the Partnership and Plan of Liquidation – Breaches in our data security systems or in systems used by our vendor partners, including cyber-attacks or unauthorized data distribution by employees or affiliated vendors, or disruptions to access and connectivity of our information systems could impact our operations or result in the loss or misuse of customers' proprietary information" for more information about the cybersecurity risks the Partnership faces.

companyName: GPB Automotive Portfolio, LP


text: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other information security risks we face, see "Item 1A. Risk Factors — Strategic and Operational Risks."

companyName: GENUINE PARTS CO

ticker: GPC


text: Our team that is responsible for assessing and our material risks from cybersecurity threats, including our Chief Operating Officer, Chief Financial Officer, and Executive Director, Head of IT Security and Compliance, which collectively have more than a combined 30 years of risk management experience. Our team's experience includes the Executive Director, Head of IT Security and Compliance, who has an extensive (25+ years) track record on cyber- and IT risks management, developing security and compliance programs and frameworks and leading IT security organizations, our Chief Financial Officer who, serving that role at Merus and prior companies and serving previously as Audit Committee chairperson for Merus and current Audit Committee chairperson at Kala Pharmaceuticals, has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, while evaluating strategies to gain a high level of cyber security, and our Chief Operating Officer, who has managed the IT organization at Merus for approximately five years and has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, and review of U.S. jurisprudence concerning protection of confidential information and trade secrets and has participated in trainings on cybersecurity threat defense and response, and cybersecurity strategies from a legal perspective.

companyName: Merus N.V.


text: No material cybersecurity incidents occurred in fiscal 2023, but future incidents cannot be predicted. Additionally, in " Item 1A. Risk Factors " under the heading "Cybersecurity and Technology Risks," forward-looking cybersecurity threats that could have a material impact on our business are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: The operation of our businesses is dependent on the secure functioning of our computer infrastructure and digital information systems. Furthermore, all our businesses require us to collect and maintain sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss. We also use third-party service providers to electronically process certain of our business transactions and perform certain cyber-related functions, such as system monitoring and critical infrastructure protection and maintenance. The confidentiality, integrity and availability of information systems, both ours and those of our third-party service providers, are vulnerable to security breaches by computer hackers and cyber terrorists and the negligent or intentional breach of established controls and procedures or mismanagement of confidential information by employees. We may also be impacted by attacks and data security breaches of financial institutions, merchants or other business partners. As part of our utility operations, we own electric generation, transmission and distribution facilities that are part of an interconnected regional grid, the operation of which is dependent on information technology systems. Parties who wish to disrupt the U.S. bulk power system or our utility operations could view our computer systems, software or networks as attractive targets for cyber-attack. Although we have not historically experienced material cyber incidents, we and other utilities are subject to cyber-attacks of increasing frequency and sophistication, and any significant interruption or failure of our information systems or any significant breach of security due to cyber-attacks, hacking or internal security breaches, could adversely affect our business and our financial condition, operating results and liquidity.

companyName: Otter Tail Corp

ticker: OTTR


text: Cyber Risk Oversight Committee. Additionally, we established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations, and pertinent information concerning cyber defense of our electronic information, information technology and operation technology systems. The CyROC is responsible for guiding our comprehensive cybersecurity policies. The CyROC is chaired by our supervisor of cybersecurity and is comprised of members from financial and operations management, as well as technology leaders.

companyName: Knife River Corp

ticker: KNF


text: In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a supplier risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our supplier risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: Blue Owl Real Estate Net Lease Trust


text: Walmart seeks to build and maintain the trust of customers, associates, shareholders and other stakeholders with respect to our use of technology and data. Our digital trust commitments, in line with our Company's values of service, excellence, integrity and respect for the individual, provide a foundation for our approach to cybersecurity.

companyName: Walmart Inc.

ticker: WMT


text: We have developed processes to identify and manage cybersecurity risks from our service providers. We assess our operators and managers through due diligence surveys, interviews and risk evaluations. We take cybersecurity and data privacy considerations into account when we source, select and engage with our third-party service providers. Moreover, we document our third-party vendors and suppliers in a centralized registry and review their cybersecurity practices through diligence meetings and SOC2 report evaluations for security, availability of data, processing integrity, confidentiality and privacy controls. These measures help ensure that our partners adhere to best practices and maintain safeguards for our data. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Lastly, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: The Company's cyber risk management program includes processes for identifying and overseeing both internal cybersecurity risks and those presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third party systems.

companyName: EPR PROPERTIES

ticker: EPR


text: To operate our business, we rely upon certain third-party service providers to perform a variety of functions, such as outsourced professional services, SaaS platforms, managed services, cloud-based infrastructure, corporate productivity services, and other functions.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: The Board and its committees provide oversight of our ERM program, including our cybersecurity risk management program and the protection and resilience of BD products, manufacturing and distribution OT, enterprise IT and BD data. In addition, our management periodically conducts cybersecurity crisis simulations and shares outcomes with the full Board to raise awareness of cybersecurity risks and enhance our incident response preparedness. We also provide Board members the opportunity to take a cybersecurity training course through an external service provider. The Board delegates oversight of our cybersecurity risk management program to the Audit Committee and the Quality and Regulatory Committee (QRC). The Audit Committee regularly reviews our cybersecurity risk management program with respect to manufacturing and distribution OT and enterprise IT, and the QRC reviews our product cybersecurity program.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Role of the Board of Directors and its Committees International Paper has an integrated board and executive-level governance structure that oversees risks from cybersecurity threats. The Company's Board of Directors has primary oversight of our enterprise risk management program, which includes cybersecurity risk. Moreover, the Board of Directors is supported in its oversight by the Audit and Finance Committee and PPE Committee, which share oversight responsibilities related to the Company's information security programs. The Audit and Finance Committee reviews management's cybersecurity and information security risk management programs and controls, including processes for management's identification and reporting of material cybersecurity incidents. The PPE Committee reviews technology issues pertinent to the Company including those associated with information and operational technology, cybersecurity and data security and assesses related Company strategies.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: We evaluate risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. We use third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: The Company's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Technology Committee and the Audit & Risk Committee. Processes for identifying, assessing, and managing cybersecurity-related risks are integrated into the Company's overall enterprise risk management process, which is overseen by the Audit & Risk Committee. The Audit & Risk Committee is responsible for monitoring risks that are being taken by the Company, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Technology Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves the Company's cybersecurity strategy for protecting the Company's information assets and technology platforms. The Audit & Risk Committee oversees the Company's Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Technology Committee and the Audit & Risk Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: As one of the critical elements of the Bank's overall risk management approach, our cybersecurity risk management program and strategy is focused on the following key areas: • Incident Response and Recovery Planning: The Bank has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Bank deploys technical safeguards that are designed to protect the sensitive information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and multifactor authentication and other access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Outside Experts: The Bank routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Bank provides regular, mandatory training for personnel regarding cybersecurity threats on matters such as phishing and email security best practices to equip our personnel with effective tools to address cybersecurity threats, and to communicate the Bank's evolving information security policies, standards, processes and practices.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor which includes a security questionnaire, a review of the vendor's written security program, and security assessment calls with the vendor's security team.

companyName: NGM BIOPHARMACEUTICALS INC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Cybersecurity threats could have a material adverse effect on our business" in Part I, Item 1A.

companyName: AUDACY, INC.


text: As part of our Global Threat Management Program, a dedicated Incident Handling Team, comprising both technical and management personnel, determines the severity of a validated cybersecurity event across the enterprise and is responsible for the development and ongoing maintenance of our comprehensive Global Incident Response Plan ("GIRP"). The GIRP is reviewed quarterly at a minimum but may be updated as needed based on lessons learned, changes in key teams or processes, or other circumstances as warranted. Within the GIRP, incident handling procedures dictate actions during each phase, which include communications, actions to be performed, methods of operation and contingencies for unanticipated outcomes. Using industry best practices and continuous improvement principles, we validate strategies, document business recovery plans, and test these procedures enterprise-wide annually. Upon the discovery of an incident, a broad cross-functional Computer Security Incident Response Team is assembled, which may include but is not limited to experts from key business, technology, legal, privacy and finance sectors, to collaboratively assess the impact and materiality in order to execute a comprehensive and informed response. After an incident is contained, a thorough review is performed to determine if any existing detective or preventative controls were bypassed, or if there was a delay in detection or response. This review, which includes members from our internal audit team, drives the implementation of corrective actions to enhance and strengthen the effectiveness of our prevention, detection, and incident response controls, as applicable.

companyName: Cigna Group

ticker: CI


text: Signet also maintains a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third-party service providers, third-party software, third-party applications and other companies with whom we do business (such as our outsourced credit card partners). Signet utilizes industry standard tools to assess the criticality of software, data assets, and operational technology. We conduct security assessments of high-risk third-party service providers before engagement to ensure compliance with our cybersecurity standards, including review of the service providers' System and Organization Controls (SOC) report to assess their cybersecurity controls and risk assessment. This approach is designed to mitigate risks related to data breaches or other security incidents originating from or otherwise due to reliance on third parties.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: The CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization. The CISO has an undergraduate degree in Management Information Systems. Members of our cybersecurity team have, combined, over 100 years of cybersecurity experience, have degrees including Bachelors in Information Systems, Management Information Systems and/or Masters in Security Technologies, and hold professional certifications including Certified Information Systems Security Professional, Global Information Assurance Certification Security Essentials, Certified Cloud Security Professional, Certified Information Systems Auditor, Microsoft Cybersecurity Architect Expert and/or Certified Digital Forensics Examiner. Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: PENTAIR plc

ticker: PNR


text: For a description about our cybersecurity risks, refer to Item 1A. "Risk Factors," to this Annual Report on Form 10-K "Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Oversee Third Party Risk Because we are aware of the potentially material risks from cybersecurity threats associated with third-party service providers, Cytokinetics implements processes to oversee and manage these risks. Depending on the nature of the services provided and the identity of the service provider, we may conduct security assessments of the provider before engagement and may monitor their compliance with our cybersecurity policies after engagement. The monitoring includes periodic assessments by our Chief Information Security Officer and on an ongoing basis by our security specialists. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: CYTOKINETICS INC

ticker: CYTK


text: The employees at our consolidated companies are the strongest assets in protecting information and mitigating risk. We monitor the security practices of our employees, including training programs that focus on applicable privacy, security, legal, and regulatory requirements that provide ongoing enhancement of their respective security and risk cultures. Our employees participate in an annual Information Security Training.

companyName: Cannae Holdings, Inc.

ticker: CNNE