text: The Chief Information Security Officer, who is primarily responsible for our cybersecurity strategy and assessing and managing risks from cybersecurity threats, works together with our Chief Information Officer, Chief Risk Officer and compliance organization, as well as other functions, in administering our information security program in a manner that satisfies applicable legal and regulatory requirements. The Chief Information Security Officer has over 18 years of experience in information security, technology audit, and technology operations and includes the design, implementation, and maintenance of greenfield cybersecurity programs for regulated specialty insurance and software-as-a-service companies. The Chief Information Security Officer has a master's degree in information technology with a specialization in cybersecurity augmented with professional designations including the Amazon Web Services ("AWS") Certified Solutions Architect Associate, AWS Certified Security - Specialty, Global Information Assurance Certification ("GIAC") Cloud Security Automation, GIAC Certified Intrusion Analyst, GIAC Penetration Tester, GIAC Web Application Penetration Tester, and Certified Information Systems Security Professional. The Chief Information Security Officer receives reports on potential cybersecurity threats from throughout the business on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Further, our team strives to stay current with respect to cybersecurity threats through training and investing in the relevant tools. Our Chief Information Security Officer, Chief Information Officer and Chief Risk Officer provide regular updates and reports to our senior leaders.

companyName: Enact Holdings, Inc.

ticker: ACT


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including 24/7 detect and response services, network activity monitoring, phishing prevention, penetration testing and periodic IT security maturity assessments. As part of these efforts, we have engaged third-party cybersecurity providers to help deploy and monitor these safeguards and to assist in the event of a security incident or similar issue by conducting forensics reviews and assisting more broadly with the mitigation and remediation of any such event.

companyName: Mueller Water Products, Inc.

ticker: MWA

secItem: Item 1C


text: Our Head of Resources Management, who is also a member of our Board of Directors, and our CCO lead our cybersecurity program. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and more than 15 years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: MOODY'S 2023 10-K 35 Committee also validates that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the executive leadership team and the Board of Directors. The Cyber Committee meets regularly to allow members of the internal cybersecurity team to present concerns and recommendations for decisions on preventing, identifying, mitigating, and remediating risks and threats. To the extent warranted, the Cyber Committee may additionally be convened on an ad hoc basis. The Cyber Committee makes decisions regarding the reporting of cybersecurity concerns to the executive leadership team, who escalate issues to the Board and/or the Audit Committee as necessary. In the case of incidents that arise, the Cyber Committee, under the direction of the Board and/or executive leadership team when appropriate, works to involve all appropriate personnel with the aim of resolving the incident, performing any required remediation/reporting, and taking appropriate steps to comply with applicable laws and regulations. The process that the Cyber Committee follows upon emergence of incidents is documented in the Company's Incident Response Plan. Additionally, cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board.

companyName: MOODYS CORP /DE/

ticker: MCO


text: While we have not, as of the date of this annual report, experienced a cybersecurity threat or incident, we cannot assure you that we will not experience such an incident in the future.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and the status on key information security initiatives.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: 24/7 Security Operations Center Managed Services ("SOC") to monitor our cyber environment, correlate logs from all technology assets to identify potential signs of compromise and perform threat hunt exercises. Enterprise-grade email security system managed services. Perform penetration tests, vulnerability assessments, and vulnerability scans of our customer-facing sites, among others.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Over the last three years, we have experienced no known information security breaches. However, as cybersecurity incidents continue to increase in scope, complexity, and frequency, we may be unable to prevent a significant incident in the future which may materially impact our results of operations.

companyName: ALLIENT INC

ticker: ALNT


text: f. Engaging an independent third-party audit firm to perform an Annual Service Organizational Controls (SOC) 2 audit of enterprise claims platforms.

companyName: HUMANA INC

ticker: HUM


text: In the event of a security risk or breach, we are prepared with response protocols aligned with National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and testing guidelines. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model to evaluate our security controls against attacker tactics, techniques, and procedures.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the audit committee. As such, our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. Management is responsible for the day-to-day assessment and management of cybersecurity risks. Management works with the third-party IT and cybersecurity firm to identify, assess and manage cybersecurity risks. Our management team includes the chief executive officer and chief financial officer, each of whom has over twenty years of experience in supervising, managing, underwriting, owning, operating and assessing the risks of commercial real estate investments and commercial real estate operating companies. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic process covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture and the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Additionally, management would notify the chair of the audit committee following any cybersecurity incident meeting specified security levels, and the audit committee would review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC. Members of our board of directors that are not members of the audit committee are also kept apprised of material risks from cybersecurity threats and our related risk management activities.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: The Company's management team is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company has a Cybersecurity Steering Committee comprised of members of management, including the CHRTO and the Company's Director of Cybersecurity, as well as other subject matter experts throughout the Company. The Cybersecurity Steering Committee has primary responsibility for the Company's overall cybersecurity risk management program and supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The experience of the members of the Cybersecurity Steering Committee includes the Company's CHRTO, who has more than 20 years of experience across various industries, and the Company's Director of Cybersecurity, who has 29 years of IT experience, including eight years leading the Company's Cybersecurity Team of IT security professionals, and who is a member of the Information Systems Audit and Control Association and the International Information System Security Certification Consortium.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Cybersecurity risk was identified as a significant enterprise risk based on the results of our most recent enterprise risk assessment. As a significant enterprise risk, management has worked to identify the underlying drivers of cybersecurity risk, identify the activities in place to manage it, and assess its residual risk level. We have developed and implemented comprehensive strategies and processes to assess, identify, manage and mitigate cybersecurity risks, aligning with the National Institute of Standards and Technology Cybersecurity Framework ("NIST-CSF"). These processes include: • implementing security event monitoring, incident response processes, access management controls, vulnerability identification and remediation, third-party risk monitoring, and user awareness and training; • providing regular security training and awareness content for all associates, with mandatory training for new hires; • maintaining cybersecurity risk insurance to mitigate potential breach-related costs; • engaging consultants to perform periodic external assessments using industry-recognized frameworks like NIST-CSF; and • monitoring program maturity through periodic reviews against the Capability Maturity Model Integration framework.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: The Company has been subject to cybersecurity threats in the past, including the Incident. We believe the impacts of the Incident were not material to MarineMax's financial condition or results of operations. In addition, as of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: MARINEMAX INC

ticker: HZO


text: The ISDG's primary functions are to: (1) serve as a governing body to support Federated Hermes' cybersecurity, information security and data governance practices and efforts; (2) address cybersecurity and information security matters and data governance matters critical to Federated Hermes, including risks; (3) oversee written policies and procedures reasonably designed to (a) comply with applicable legal requirements, and (b) maintain appropriate cybersecurity, information security and data governance practices; (4) promote evaluation of Federated Hermes' strategies for cybersecurity, information security and data governance against industry practices and applicable regulatory requirements and guidance; and (5) serve as a liaison for discussions concerning cybersecurity, information security and data governance with various Federated Hermes committees or governing bodies, management, and Federated Hermes' board of directors. The ISDG receives updates quarterly on relevant cybersecurity and data governance matters, such as recent cybersecurity matters, phishing test results, cybersecurity training, GTO and ISG staffing, FHL's cybersecurity program, regulatory developments, and enterprise data governance and strategy.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Through these internal and external assessments, we continuously identify areas for remediation and opportunities to improve the security of our information systems, including by evaluating our program against industry standards and best practices, such as the Cybersecurity Framework established by the National Institute of Standards and Technology (NIST) and the CIS Critical Security Controls established by the Center for Internet Security. We also track key performance indicators that we believe are indicative of the effectiveness of our cybersecurity risk management program.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: We are a holding company. Yubo Beijing has implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and its critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data related to its stem cell bank and customers of its light application products and health related services (collectively, the "Information Systems and Data").

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: Additionally, the A&FC has general oversight over Unisys' cybersecurity as it relates to responsibility for Unisys' internal audit function, including cybersecurity practices, compliance with legal and regulatory requirements and internal control over financial reporting. In November 2023, the A&FC charter was amended to ensure that it, in conjunction with the S&RC, reviews Unisys' cybersecurity and other information technology controls and procedures no less than annually. Management's Role in Assessing and Managing the Company's Material Risks from Cybersecurity Threats.

companyName: UNISYS CORP

ticker: UIS


text: The Global Chief Information Security Officer ("CISO") is responsible for J.P. Morgan's Information Security Program, which includes managing its global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, overseeing its policies and standards relating to information technology risk and security management, and enhancing, as needed, its information security capabilities. The CISO reports to the Global Chief Information Officer and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO is responsible for J.P. Morgan's Information Security Program, which is designed to prevent, detect and respond to cyber-attacks to help safeguard the confidentiality, integrity and availability of J.P. Morgan's infrastructure, resources and information. The program includes managing J.P. Morgan's global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing J.P. Morgan's policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, J.P. Morgan's cybersecurity capabilities.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures. These reviews include updates from our management team and periodic executive sessions with our Chief Information Officer ("CIO") covering cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: Our CISO, who reports both to our Chief Risk Officer and our Chief Information Officer, manages the Bank's information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our CISO has more than 15 years of experience in cyber security matters, including over 13 years in information technology with the Bank in roles of increased responsibilities. Our information security department executes our cybersecurity risk management program, and is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our Board of Directors. Our threat and incident response team, a subset of our information security department, is responsible for responding to potential threats that may require a system change, modifications and other methods to maintain business continuity to minimize cybersecurity threats. Personnel in the security program hold a variety of technical certifications relevant to their job functions and engage in continuing education.

companyName: Federal Home Loan Bank of Chicago


text: Our Head of Information Technology, or IT, with the support of our third-party information technology service providers and a team of IT professionals, is responsible for the strategic leadership and day-to-day management of our cybersecurity program, including the prevention, detection, mitigation, and remediation of cyber incidents. The individual serving as Head of IT has more than twenty-five years of experience in information technology and information security.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: The Company's cybersecurity strategy includes recognition and deployment of the following: a. A formal approach to enterprise risk management encompassing finance, operational risk management, and Information Technology ("IT") to manage the business and technology-related challenges and required regulatory compliance obligations i. Board approved Information Security policies that are reviewed bi-annually ii. An IT infrastructure architecture that has been designed and implemented with security at its core in order to enable key business activities while ensuring the confidentiality, integrity, and availability of our technology infrastructure and critical business and customer data. The Network Security Architecture design focuses on our ability to: i. Identify and understand organizational risks to critical systems, assets, data & capabilities ii. Protect our environment by putting in safeguards iii. Detect potential threats by developing and implementing the appropriate activities to identify the occurrence of a cybersecurity event iv. Respond to and take the appropriate action regarding a detected cybersecurity incident v. Recover and restore any capabilities or services that were impaired due to a cybersecurity incident To reduce the risks from cybersecurity threats associated with our use of third-party service providers, we have a supplier relationship policy and process which outlines information security requirements for mitigating the risks associated with supplier's access to our organization's assets. This policy must be agreed to by the supplier, documented, and reviewed annually.

companyName: SelectQuote, Inc.

ticker: SLQT


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled " We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology, including related to artificial intelligence, could harm our business. Privacy and security laws and regulations may also increase costs for our business. " under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: Among other things, the Company's privacy team actively develops and implements policies designed to comply with the requirements of privacy laws in the countries where the Company operates. Working with Internal Audit and the CIO, the privacy team assesses the nature and potential severity of privacy risks within DaVita and guides the organization in taking steps to help mitigate such risks. The Audit Committee also oversees the Company's negotiation of any cybersecurity insurance. Currently, the Company maintains a cybersecurity risk insurance policy providing coverage for certain cybersecurity breaches among other specified risks.

companyName: DAVITA INC.

ticker: DVA


text: Our framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. O ur cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment. We use a third-party consultant to provide us with advisory, project execution, and operational support in connection with cybersecurity and to conduct NIST assessments and vulnerability evaluations. Cybersecurity awareness training of our employees, incident response personnel, and senior management.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs. The Audit Committee oversees management's implementation of our information security program and receives periodic reports from management on our material cybersecurity risks. Additionally, management updates the Audit Committee, as necessary, regarding material cybersecurity incidents. The full Board receives quarterly updates from management on our information security program.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: The Company has a written incident response plan ("IRP") and conducts annual tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in the technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Certain employees, including those with access to Company-provided e-mail accounts, undergo security awareness training when hired and at least annually thereafter.

companyName: LA-Z-BOY INC

ticker: LZB


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional ("CISSP") certification.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: The ERM Program works with risk owners to gather, evaluate, and prioritize risk information through the completion of a risk assessment and creation of a risk profile document. Top risks, including those related to cybersecurity, are evaluated through a detailed risk assessment, and the risks are reexamined periodically as needed. InfoSec performs an annual refresh of an information security risk profile document as required by this process, and the results of such assessment are reported out for escalation, prioritization and reporting on an annual basis.

companyName: EQUINIX INC

ticker: EQIX


text: The Audit Committee operates under a written charter adopted by the Company's board of directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: Sow Good Inc.

ticker: SOWG


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats, have materially affected or are likely to materially affect Atkore, including our business strategy, results of operations or financial condition.

companyName: Atkore Inc.

ticker: ATKR


text: The Company also has a cross-functional Cybersecurity Incident Response Team consisting of senior-level management. This team is responsible for cybersecurity incident oversight and meets as needed, depending on the nature of an incident. The Company's internal audit team also provides independent assurance on the overall operations of the Company's cybersecurity program. The Company ensures that all employees, including part-time and temporary employees, undergo cybersecurity training and compliance programs at least annually.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: For additional information on how risks from cybersecurity threats may adversely affect the Company see "Item 1A. Risk Factors-Risks Related to Our Business" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other risk areas. We have also implemented a specific cybersecurity program which adopts a risk management approach to information security, requiring the identification, assessment, and appropriate mitigation of vulnerabilities and threats that can adversely impact our information assets. Our cybersecurity program is aligned with recognized industry standards and frameworks such as NIST SP 800-53, NIST SP 800-82, and the NIST Cybersecurity Framework 2.0. Our cybersecurity program includes: • An Information Security Charter and supporting policies outline governance, define responsibilities, and help enforce our cybersecurity program; • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • An information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for customers, service providers, suppliers, and vendors.

companyName: Oil-Dri Corp of America

ticker: ODC


text: c. The Company's approach to managing cybersecurity and digital risk is led by our CIO and CISO. Our CIO is supported by the Company at the highest levels and regularly engages with cross-functional teams at the Company, including Legal, Audit, Finance, Human Resources and Enterprise Risk Management.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: The Director of Global Cybersecurity and the Chief Information Officer, in coordination with the Cybersecurity Department and other appropriate personnel, are responsible for assessing and managing the Company's material risks from cybersecurity threats. Our Director of Global Cybersecurity has served in various roles in information technology and information security for over 25 years, has been in the current role with the Company for more than 10 years, and has been trained and accredited in multiple cybersecurity subjects including training with governmental agencies. Our Chief Information Officer has served in various roles in information technology and information security for over 25 years, has been in the current role with the Company for more than 10 years, and holds a Master of Business Administration degree with a concentration in information systems management.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: The Rocket Companies Information Security Program ("Program") is managed by the Rocket Companies Chief Information Security Officer ("CISO"), who is responsible for the creation and execution of our information security strategy. The CISO has more than 30 years' experience managing business risk and developing and implementing information security strategy.

companyName: Rocket Companies, Inc.

ticker: RKT


text: We have not experienced any cybersecurity incidents that have materially affected our Company, including our business, strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats may be reasonably likely to materially affect us, refer to Item 1A. Risk Factors – Risks Related to our Business – "We rely on information technology and telecommunications systems, many of which are provided by third-party vendors" and – "Cyberattacks or other security breaches could adversely affect our operations, net income or reputation," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. From time to time, we have experienced cybersecurity incidents in the normal course of our business. As of the date of this report, we are not aware of any cybersecurity incident or threat that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future cybersecurity incidents could materially affect our strategy, results of operations or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.

companyName: Installed Building Products, Inc.

ticker: IBP


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset manager with $246 billion in assets under management as of December 31, 2024. TPG offers a broad range of investment strategies across the alternative asset management landscape, primarily in private equity, credit, and real estate. We, in conjunction with our Manager and TPG, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include risk assessments of internal and external threats to the confidentiality, integrity and availability of our and TPG's data and systems along with other material risks to firm operations.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: Simulated exercises: We regularly run simulated attack exercises to ensure our teams are prepared to act swiftly and effectively during an actual cyberattack. Risk Management and Oversight Committee We conduct comprehensive risk assessments to identify vulnerabilities across systems, processes, and third-party dependencies.

companyName: Health In Tech, Inc.

ticker: HIT


text: The use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity processes; A cybersecurity incident response plan.

companyName: CYANOTECH CORP

ticker: CYAN


text: PyraMax Bank recognizes the critical importance of cybersecurity in maintaining the integrity, confidentiality, and availability of its systems and data. As a financial institution entrusted with sensitive customer information and financial assets, PyraMax Bank is committed to implementing robust cybersecurity risk management practices, strategies, and governance mechanisms.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: While our Board is responsible for ensuring that our entire ERM process is in place and functioning, our Audit Committee has the primary oversight responsibility for risks relating to cybersecurity. Our Vice President of Information Security regularly attends and presents to our Audit Committee on material cybersecurity risks and mitigating procedures. Our Vice President of Information Security oversees ProAssurance's information security and data privacy programs and is responsible for establishing and implementing our security strategy alongside our General Counsel, to whom the Vice President of Information Security reports directly. Our Vice President of Information Security has been with ProAssurance since 1998 and has over 26 years of IT and cybersecurity experience.

companyName: PROASSURANCE CORP

ticker: PRA


text: As indicated above, we have an IT security team, led by our chief information security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. The security team's leadership has an average of over 12 years of prior work experience in various roles including monitoring, response, compliance and privacy. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: GameStop Corp.

ticker: GME


text: maintain an employee handbook, Code of Conduct, and Acceptable Use policy that makes clear the importance of cybersecurity and protection of PDF and customer intellectual property; and our incident response policy and plan specify the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage. We regularly exercise and update the plan after actual incident responses or simulated incident response scenarios.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our Chief Technology Officer is responsible for developing and executing our information security program. The Chief Technology Officer partners with key corporate functions for the purpose of identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures, reporting cybersecurity breaches and other information security incidents, and maintaining our information security program. The Chief Technology Officer has more than a decade of information technology leadership experience, including responsibility for cybersecurity matters. Our information security team, reporting to the Chief Technology Officer, have appropriate cybersecurity experience and education, including CISSP and CompTIA certifications. Our management team receives regular updates on our cybersecurity posture and reviews detailed information about our cybersecurity preparedness. At least quarterly, management provides the Board and the Audit Committee with updates about our cybersecurity and related risk exposures, our policies and procedures to mitigate such exposures and the status of projects to strengthen our information security infrastructure and program maturity and defend against and respond to cybersecurity threats.

companyName: EXP OldCo Winddown, Inc.


text: We have integrated cybersecurity risk management into our enterprise risk management program, and our management, lead by our Global Information Technology Director, regularly review cybersecurity risks. We rely extensively on information technology ("IT") systems for the storage, processing, and transmission of our electronic, business-related information assets used in, or necessary, to conduct business. We leverage our internal information technology infrastructures, and those of our business partners, to enable, sustain, and support our global business activities. In addition, we rely on networks and services, including internet sites, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors, to assist in conducting our business.

companyName: ALLIENT INC

ticker: ALNT


text: The full Board of Directors is responsible for the oversight of the Company's cybersecurity risk management. The Board is updated by the EVP, Global Supply Chain & Import regularly to remain informed on the Company's efforts in managing risks associated with cybersecurity threats.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: We examine the effectiveness of our cyber defenses through various means, including internal audits, targeted testing, vulnerability testing, maturity assessments, incident response exercises and industry benchmarking.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: To assess and manage cybersecurity threats from material risks, the Bank maintains an Incident Response Team comprised of members from the major business areas in the Bank to ensure appropriate subject matter experts are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Bank's business strategy, results of operations, or financial condition by following implemented processes. The Bank has not identified any cybersecurity threats that have materially affected operations or financial position.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: Management of cybersecurity risks is an integral part of our overall risk management framework and is essential for safeguarding our business and data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Village Farms International, Inc.

ticker: VFF


text: The Vice President, Information Security and Audit Information Security Officer has 27 years as an IT Professional, with the last 8 as the cybersecurity leader for Horizon Bank with an education background in Technology. He has achieved numerous certifications throughout his career including the Microsoft Certified Systems Engineer (MCSE) and Certified Novell Engineering (CNE 5/6), and has demonstrated a continued commitment to excellence and has attained certification as a Certified Information Systems Security Professional (CISSP) issued by ISC2 in 2022. Through continuous learning and professional development, the Information Security Officer has honed his expertise in cybersecurity frameworks, threat detection, incident response, and risk management. He also serves as a member of the Indiana Bankers Association (IBA) Cyber Security Committee and attends numerous industry training sessions including those put on by Microsoft, FS–ISAC, SANS Institute.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: We describe how risks associated with a potential cybersecurity incident are reasonably likely to materially affect us, including our business, results of operations and financial condition, under the heading "A significant information security or operational technology incident, including a cyberattack or a data breach, could disrupt our operations and adversely impact our operating results, cash flows and reputation," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: For further discussion relating to this topic, see Item 1A. Risk Factors "The Company's information technology systems may be negatively affected by cybersecurity threats."

companyName: AURA SYSTEMS INC

ticker: AUSI


text: Gover nance the importance of information security, privacy and data protection to our stakeholders, cybersecurity is a critical part of our risk management program and a key focus area for our Board and Executive Management. The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help manage our risk exposure to meet our strategic objectives. Executive Management and our Information Security Officer ("ISO") regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: The cybersecurity function, is led by the Company's Chief Information Officer ("CIO"), who reports to The Company's Chief Operating Officer ("COO"). The Chief Information Security Officer ("CISO") reports to the CIO and generally is responsible for management of cybersecurity risk and the protection and defense of the Company's networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including threat assessments and detection, mitigation technologies, cybersecurity training, incident response, insider threats and regulatory compliance.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. Chevron's CISO regularly receives cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on Chevron's networks and third-party supplier networks. The CISO has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents are provided to senior management and to the Board, as appropriate.

companyName: CHEVRON CORP

ticker: CVX


text: Our Chief Technology Officer (CTO) is responsible for oversight of our information security strategy, program, and operations. The CTO has over 25 years of information technology experience, including leadership experience managing global information security, IT infrastructure and engineering. He holds a doctorate in Business Administration, Master of Business Administration, and Bachelor of Engineering in Electrical and Electronics Engineering / Information Systems. In previous roles at large scale fintech and cybersecurity companies, the CTO has designed comprehensive cybersecurity programs and managed and mitigated high profile cybersecurity incidents to ensure business continuity.

companyName: NCR Voyix Corp

ticker: VYX


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: Identified Risks As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations and/or financial condition. For more information about these risks, see the risk factor titled "Our operations are subject to cybersecurity risks that could have a material adverse effect on our results of operations and financial condition" under Item 1A of Part I of this Annual Report.

companyName: Nine Energy Service, Inc.


text: The Audit Committee of the Board of Directors oversees the technology functions, including management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior technology leadership, including our Chief Information Security Officer (CISO), briefs the Audit Committee of the Board of Directors on our cybersecurity and information security posture semi-annually and on an as needed basis and the full Board of Directors is apprised on an annual basis. In the event of an incident, we strive to follow our detailed incident response playbook, which outlines the steps to be taken from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), customers, as well as senior leadership and the Board, in each case, as appropriate.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which does include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider's cybersecurity posture.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Information technology and the digital transformation of our assets and business processes are critical to our growth strategy. Inherent to information technology and digital transformation is the commensurate cybersecurity risk, which we manage by maintaining a cybersecurity program that is integrated into our overall risk management process.

companyName: Third Harmonic Bio, Inc.


text: To date, the Company has not had a cybersecurity event that materially impacted or is reasonably likely to materially affect its business strategy, results of operations, financial condition, or the security of its proprietary data.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or customers, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. is an important part of our risk management processes and an area of focus for our Board and management.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our common stocks and our ability to pay distributions."

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our security operations center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions team for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the board of directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board and the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Monitoring Cybersecurity Incidents Our Director of IT Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have in place a detailed incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. In addition, our Director of IT Security is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition assists in the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: ZimVie Inc.


text: As of the date of this report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted us, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience such an event moving forward and if realized, that we, or our business strategy, results of operations, or financial condition, would not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. As part of our enterprise-wide risk management strategy and commitment to continuous improvement, we are actively pursuing ISO/IEC 27001 certification, the internationally recognized standard for information security management systems. We have initiated the formal implementation process, including a comprehensive gap assessment and roadmap development. Progress toward certification is regularly reviewed by the IT Steering Committee and reported to the Board of Directors.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: We use third-party service providers to perform a variety of functions throughout our business, including, but not limited to infrastructure support and maintenance, CRM, contract management, data hosting, and miscellaneous finance and accounting projects. We assess our vendors with respect to cybersecurity risk according to the services provided, the sensitivity of the Information Systems at issue, and the provider's identity. In appropriate cases, we will seek enhanced contractual obligations or guarantees related to cybersecurity on the service provider. Vendor risk assessments are performed before each vendor is engaged, and annual reviews are conducted to ensure vendors continue to meet security requirements.

companyName: OptimizeRx Corp

ticker: OPRX


text: Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Head of Human Resources, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: We have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by our Chief Information Officer (CIO) and our Cyber Security Risk Officer (CSRO).

companyName: HORTON D R INC /DE/

ticker: DHI


text: Governance of cybersecurity risk management The Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. Our Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: The Company recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. The Company believes that cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: As is the case for most companies, we are regularly subject to cyberattacks and other cyber incidents, and, therefore, cybersecurity is an important element of our ongoing information technology operations. We devote significant resources to protecting and enhancing the security of our computer systems, business information, software, networks and other technology assets, by applying our cybersecurity risk management processes, which consider physical, procedural and technical safeguards. We have a multi-faceted program for assessing, identifying and managing cybersecurity risks, that is designed to help protect our information assets and operations from internal and external cyber threats by: • organizing our cybersecurity efforts based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework by applying the framework's rubric of Govern, Identify, Protect, Detect, Respond, and Recover; • seeking to understand, manage and mitigate risk while ensuring business resiliency and protecting business, employee and patient information from unauthorized access or attack; • identifying critical business information, the lifecycles of that information, and the systems where this information is stored, distributed, processed, and eventually destroyed. For example, by managing important external parties and their operations, analyzing their cybersecurity risk to our business operations, and reviewing the residual risk with business leaders to accept and manage each external party appropriately; • protecting and securing our systems from attack with secure configuration standards and protective cybersecurity tools; • detecting potential attacks through appropriate tools, including cybersecurity-related data collection and analysis to help identify potential attacks; • responding to alerts from those tools with processes to verify whether there is a real incident and the severity of that incident using appropriate resources and team members, including establishing and exercising a Cybersecurity Incident Response Plan ("IRP") based on recognized industry practices, including NIST guidance; and • establishing and exercising processes and procedures to recover from cybersecurity incidents.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: We conduct regular cybersecurity assessments with independent firms and annual evaluations for compliance with Payment Card Industry – Data Security Standards (PCI DSS) and benchmark maturity assessments aligned with the NIST Cybersecurity Framework version 2.0. Our Internal Audit department evaluates our information security program through annual information security and cybersecurity audits. We also perform internal controls testing as Section 404 of the Sarbanes-Oxley Act mandates.

companyName: PVH CORP. /DE/

ticker: PVH


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems, internal networks and information.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: We maintain multiple levels of protection to mitigate data security risks, and we regularly test our systems to discover and address potential vulnerabilities, including without limitation: • using a multi-layered, zero-trust principled approach to secure systems; • systematic monitoring of our sites and services to detect and respond to unauthorized activity; and • regular security audits and vulnerability assessments conducted by our dedicated internal information security team, our internal auditors, and by external third parties.

companyName: H&R BLOCK INC

ticker: HRB


text: Management of Cybersecurity Risk Our Cybersecurity Risk Management Processes Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by identifying and escalating risks, issues, and key decisions to management, the Audit Committee, and our Board. We designed our program to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents. In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and on a periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.

companyName: Lucid Group, Inc.

ticker: LCID


text: Our CIO and his security management team possess primary responsibility for identifying, assessing, monitoring, and managing our cybersecurity risks. Our Board of Directors directly oversees cybersecurity risks, which includes conducting an annual review of the Company's cybersecurity risks, management's actions to identify and detect threats, management's action plans for response and recovery situations, and review of recent enhancements to the Company's defenses and strategic cybersecurity roadmap. In addition, the Audit Committee receives quarterly cybersecurity updates, which include a review of new processes implemented to monitor cyber risks, and a summary of any recent threats and the Company's response to those threats.

companyName: M/I HOMES, INC.

ticker: MHO


text: Our CISO and CIO regularly advise the Audit Committee on cybersecurity risks and the company's cybersecurity program, including quarterly updates and comprehensive briefings to the Audit Committee at least annually. During these briefings, our cybersecurity leaders advise the Audit Committee regarding (i) the current threat landscape and related risks; (ii) the Company's security posture and compliance efforts; and (iii) current cybersecurity strategy and recommended next steps to address cybersecurity threats on a risk-adjusted basis.

companyName: Enpro Inc.

ticker: NPO


text: Our Chief Financial Officer and Corporate Controller oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2023 or up to the date of this filing.

companyName: Salamander Innisbrook, LLC


text: We devote significant resources and efforts to protecting the security of our information technology and operational systems, including utilizing threat monitoring and commissioning assessments by third parties, taking guidance from ISO information security standards, and conducting proactive risk and compliance reviews against regulatory, industry, and evolving data privacy requirements. We provide training to our employees on our acceptable use policy, our data protection methods, and social engineering tactics used by threat actors, including through simulated phishing attacks. We maintain a cross-functional cybersecurity incident management procedure with defined roles, responsibilities, and reporting protocols that is designed to timely respond to, investigate, mitigate, remediate, and if appropriate, disclose, a cybersecurity incident. Furthermore, we practice our response to potential cybersecurity incidents through tabletop exercises.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: We have a formal IT Security Policy to provide appropriate governance over information security including control requirements for change management and patching, multifactor authentication, data backup, security monitoring, mobile device management and asset management. Management performs annual testing of security controls and results are reported to the Audit Committee. In addition, management has a formal incident response plan and has contracted with a cybersecurity operations vendor to provide 24x7 monitoring/management of our infrastructure and systems. The incident response plan addresses the lifecycle of incidents including identification, response and recovery, and the plan is tested at least annually. In addition, we carry insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: The security and privacy of our users and their data is our priority, and we proactively manage cybersecurity risks to ensure robust protection for our platform. We integrate cybersecurity risk management into our overall organizational strategy. Our Board of Directors oversees risk management, including cybersecurity. Key elements of our framework include:

companyName: Mega Matrix Corp.


text: Our Board of Trustees oversees management's process for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Board of Trustees has also delegated authority to its Audit Committee to review our internal controls relating to information technology, data privacy, including data protection and cybersecurity, including network security and cloud security. Senior leadership, including our Senior Vice President of Information Technology (the "SVP of IT"), meets with the Board of Trustees at least annually to present and discuss strategies and cybersecurity initiatives. This meeting includes reporting of cybersecurity incidents at least annually or more often, if identified.

companyName: CENTERSPACE

ticker: CSR


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity. Agendas for quarterly updates are developed and adjusted throughout the year to adapt to any emerging risks or key topics and include, a wide range of information, including the prevailing cybersecurity threat landscape, investments in infrastructure, trainings programs and opportunities for bolstering the security of our company's systems and the protection of our products and operations. The full Board of Directors receives regular reports from the Audit Committee and our management on our cyber security program and the emerging threat landscape.

companyName: Ameresco, Inc.

ticker: AMRC


text: We recognize cyber threats are a permanent part of the overall risk landscape and cybersecurity threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority for us.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the Company's networks, the Company's information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. The Company contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, the Company has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates to reduce the Company's risk.

companyName: SITE Centers Corp.

ticker: SITC


text: Our Chief Information Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: To date, we have not experienced a material cybersecurity breach and no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While the New Manager has implemented processes and procedures that it believes are tailored to address and mitigate the cybersecurity threats that our Company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: we are not aware of any cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.

companyName: Corvex, Inc.

ticker: MOVE


text: We conduct a cybersecurity risk assessment at least annually that takes into account information from internal resources (e.g., vulnerability scans, incident reporting), known information security vulnerabilities, and information received from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants).

companyName: Skillz Inc.

ticker: SKLZ


text: The Finance/Risk Management Committee oversees the formal process to identify risks company-wide, allocate them to the appropriate committee of the Board of Directors, and ensure that risk mitigation activities are being followed. At each of its meetings, the Finance/Risk Management Committee receives presentations from our Chief Information Officer (the "CIO") on cybersecurity and information security risk, as well as our cybersecurity initiatives.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards. Our head of information technology, who has 25 years of information technology management experience, reports to our chief financial officer, oversees and manages the day-to-day functions of our cybersecurity risks, and works with an incident response team to evaluate security and privacy incidents and the implementation of appropriate actions.

companyName: CURIS INC

ticker: CRIS


text: The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Senior Director of Cybersecurity, who functions as the chief information security officer (CISO). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology ("IT"), legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned "A disruption, breach, or failure in the operational systems or infrastructure of our third party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business" in Item 1A. Risk Factors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our information security and technology risk management processes are designed and working as intended.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We design and assess our program based on various cybersecurity frameworks, most prominently the Health Information Trust Alliance ("HITRUST") Common Security Framework, and Service Organization Controls ("SOC") 2, developed by the American Institute of CPAs. In 2023, our cybersecurity systems and services issued a SOC 2 Type 1 report for the design of our security processes. We use this cybersecurity framework and information security controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: The Bank has an Information Security Department comprised of specialized professionals that is responsible for the day-to-day, hands-on management of cybersecurity risk and that handles the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect the Bank against those risks. The Bank's Information Security Department is responsible for developing, documenting, and approving the Bank's technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control.

companyName: Federal Home Loan Bank of New York


text: Education and Awareness Recognizing that human error can often be a weak link in cybersecurity defenses, we are committed to regular and comprehensive training for all employees and executives. This includes annual cybersecurity awareness sessions for our Board, ensuring that our highest levels of leadership are informed and vigilant about the latest cybersecurity trends and threats. Our training programs are designed to foster a culture of security awareness, equipping our team with the knowledge and tools needed to recognize and prevent cyber threats.

companyName: Paysign, Inc.

ticker: PAYS


text: We recognize the intricate and ever-changing nature of cybersecurity threats. To address this, we shall collaborate with external experts, including cybersecurity assessors and consultants. This cooperation shall involve regular audits, threat assessments, and consultations to enhance our security measures. These efforts ensure that our cybersecurity strategies adhere to industry best practices and remain effective in safeguarding our systems.

companyName: SEATech Ventures Corp.

ticker: SEAV


text: Cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are made by groups of individuals with a wide range of expertise and motives which increases the difficulty of detecting and successfully defending against them. However, to date, cybersecurity threats have not materially affected us, including our business, strategy, results of operations or financial condition.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the our service delivery; however, potential vulnerabilities to known or unknown threats will still remain and we may not be able to prevent security incidents in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: Cohen & Steers has implemented and maintained various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software and critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to Advisor clients and investments ("Information Systems and Data").

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Board Governance Visa's board of directors exercises oversight and control of Visa's overall enterprise risk management framework and delegates oversight and control of Visa's cybersecurity program to our audit and risk committee (ARC), which is responsible for ensuring that management has risk-based processes in place designed to assess, identify, and manage cybersecurity risks to which Visa is exposed. As noted in Item 1A, however, these processes may not be sufficient to mitigate all cybersecurity risks. Our CISO provides an update on our cybersecurity program to the ARC twice per year and to the full board of directors annually. The updates to the ARC and the full board of directors provide an overview of our cybersecurity performance, progress against goals, cybersecurity threat landscape, and other relevant developments.

companyName: VISA INC.

ticker: V


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity third-party risk management process for service providers, suppliers, and vendors.

companyName: SurgePays, Inc.

ticker: SURG


text: The company continuously monitors its information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. The company's process for identifying and assessing material risks from cybersecurity threats operates alongside the company's broader overall risk assessment process. The company monitors risks through active (e.g., penetration tests and vulnerability scans) and passive (e.g., end-point protection) methods and addresses system alerts on a constant basis. The company's cybersecurity team immediately investigates system alerts that may indicate the presence of a cybersecurity threat or incident and escalates information regarding the threat or incident as necessary to address it in a timely manner. The company also maintains an incident response plan, which sets forth processes the company will follow to address a significant cybersecurity threat or incident. The incident response plan, among other things, provides for inter-departmental coordination and management of cybersecurity threats or incidents to quickly assess the impact, mitigate risks to information systems, and work to resolve vulnerabilities. Depending on the threat or incident, the company may utilize third-parties under retainer for assistance in investigating and addressing cybersecurity incidents or threats.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: The oversight of our cybersecurity is assigned to the Audit Committee of our Board of Directors. The Audit Committee receives regular reports and briefings from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs, and many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: The Company's management, including through its oversight of the Company's policies and procedures regarding cybersecurity, is actively involved in the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company. Management's oversight is augmented through the Company's Enterprise Risk Management Framework, which includes risk and control assessments related to the Company's cybersecurity program. Additionally, the Company's Internal Audit Group periodically audits aspects of the Company's cybersecurity program and provides reports to the Board's Audit Committee, and an external audit firm conducts an annual SOC 2 attestation of the Company's information security controls.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I Item 1A "Risk Factors – We depend on information technology for our business and are exposed to risks related to cybersecurity threats and cyber incidents affecting our, our customers', suppliers' and other service providers' systems and networks."

companyName: KLA CORP

ticker: KLAC


text: Cybersecurity Program Components Our cybersecurity program includes a focus on governance, process, technology and people. Key components include prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. For example, to effectively manage cybersecurity risks, we maintain an asset inventory and classify critical systems to ensure appropriate protection measures. Our risk management processes include regular assessments of internal and third-party risks, which are aligned with our ERM strategy. We enforce cybersecurity policies, standards, and governance practices, ensuring they align with regulatory requirements and industry best practices. Additionally, we conduct periodic business impact analyses to strengthen resilience and inform risk-based decision-making.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, the Risk Committee, our Chief Information Officer ("CIO"), other members of management and management's Cybersecurity Committee.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our President and Chief Executive Officer.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: The Company has taken steps to gain insights into how cybersecurity risk management functions have been integrated into its overall risk management systems and process. Below are the risk management activities regularly performed: • Cybersecurity, as described above; • Financial control risk assessment which is a formal part of the annual internal control program; • Management's risk assessment associated with the budgeting and strategic planning process; • Legal risk assessment associated with our response to the Department of Justice proceeding, and • A broader fraud risk assessment (also performed as part of the internal control program).

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: The Program is overseen by the Company's Risk Committee, First Technology Services Board of Directors, Technology Risk Committee, and Security Advisory Committee. Additionally, the First Financial Trust and Asset Management Board of Directors oversee the Program as it relates to the trust subsidiary. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: Information technology and data security, particularly cybersecurity, are areas of focus for our management. We employ a ready-made security model that we acquired from well-known vendors for risk-based controls with a focus on protecting our data. We follow a cloud-first approach to enable scaling, business continuity, and access to technology innovations and updates.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: IT Risk Management The Company maintains an Information Technology (IT) risk identification process that encompasses risks associated with enterprise solutions and products and services provided by third-party service providers. Cybersecurity risks are considered a subcategory of IT risks and are therefore part of this process. The Company maintains a risk register to document and track IT risks, including factors such as: Categories (including but not limited to cybersecurity, data privacy, governance, and application development)

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Our Board performs oversight of our risk management process. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various standing committees of the Board that address risks inherent in their respective areas of oversight. In particular, the Board is responsible for monitoring and assessing strategic risk exposure, including a determination of the nature and level of risk appropriate for us. The Board is also focused on emerging risks, as well as risk mitigation strategies. As part of its risk mitigation duties, the Audit Committee monitors cybersecurity risk and mitigation of such risks.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Pursuant to our Audit Committee Charter, our Audit Committee is responsible for reviewing and assessing our risk assessment and risk management policies, including oversight of cybersecurity risk. Our risk assessment policy is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. Our Board of Managers, with the assistance of our Audit Committee and Technology Committee, regularly reviews our cybersecurity program with management and reports to the Board of Managers. Messrs. Wallach and Sheldon, both members of our Technology Committee and our Board of Managers, bring extensive experience in security governance, risk, and compliance, with prior leadership experience in public and private companies, where they closely worked with massive IT departments to handle with cybersecurity risks, information technology and data protection. Cybersecurity reviews generally occur at least annually, or more frequently as determined to be necessary or advisable. We have an escalation process in place to inform senior management and the Board of Managers of material issues.

companyName: Shepherd's Finance, LLC


text: Caterpillar Cybersecurity Governance Caterpillar's board has oversight for risk management with a focus on the most significant risks facing Caterpillar (including its wholly owned subsidiary, Cat Financial), including strategic, operational, financial and legal compliance risks. The Caterpillar board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which Caterpillar's cybersecurity processes are an integral component.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: We perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk. As part of our risk assessment process, we incorporate results from procedures performed by third-party consultants. We utilize third-party consultants to perform penetration and vulnerability testing and monitoring, as well as overall cybersecurity control testing. Potential risks associated with the use of third-party service providers are monitored and managed through an established service provider management policy. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements and data disposal commitments.

companyName: Otter Tail Corp

ticker: OTTR


text: Our information security team is led by our CSO. Mr. Friedman has held the position of CSO at organizations across multiple industries, including financial services, for over 13 years and holds industry security certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified Information Security Manager, and Certified in Risk and Information Systems Control. Many members of the information security team also hold CISSP, CISA and other security related certifications. The information security team is made aware of security risks and incidents through a number of channels and activities: • performance of risk assessments on at least an annual basis by the Security Risk Committee; • providing SOC capabilities for the detection and response of cyber incidents; • serving as the point of contact for reporting actual or suspected cyber incidents; • managing compliance and certification for in-scope security related compliance frameworks and regulations; • managing internal and external penetration tests, vulnerability scans, and the Company's vulnerability disclosure program; and • monitoring of cyber threat intelligence and evaluation and analysis of the potential impact of "zero day" vulnerabilities.

companyName: LIVEPERSON INC

ticker: LPSN


text: Strategy and Governance Given the importance of the integrity and security of the information and data utilized in our day-to-day operations, our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our overall enterprise risk management framework. We evaluate cybersecurity risks on an ongoing basis, and both our executive management and Board of Directors have an overall responsibility for assessing and managing risks from cybersecurity threats. We have established an information security team which is structured into three areas, that all report directly to our Chief Information Security Officer (CISO): 1) Governance, Risk and Compliance; 2) Architecture; and 3) Operations (Detect and Respond). Our information security team is responsible for the design and execution of our cybersecurity risk management and helps executive management and our Board of Directors stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, including but not limited to, briefings with internal security team members, threat intelligence obtained from public and private sources and alerts and reports produced by security tools deployed within our IT environment. Our current CISO, who reports directly to our Chief Information Officer (CIO), has over 17 years of experience in various roles involving information technology governance and compliance, including cybersecurity, engineering and enterprise architecture, while our CIO has over 25 years of IT and cybersecurity experience. Our information security team includes professionals with relevant industry, educational and cybersecurity experience.

companyName: Elanco Animal Health Inc

ticker: ELAN