text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to customers, reputational damage adversely affecting customer or investor confidence and violation of data privacy or security laws. Our Sponsor maintains an enterprise-wide cybersecurity program to protect and defend against and manage foreseeable cybersecurity risks and threats, including for the Company. The cybersecurity program is administered by the Sponsor's Chief Technology Officer ("CTO"), who has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Based on the NIST standards, our cybersecurity program breaks down its efforts to manage cybersecurity risk into five (5) pillars: identify, protect, detect, respond and recover.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH

secItem: Item 1C


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our President and Chief Financial Officer. The Board of Directors also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Neurogene Inc.

ticker: NGNE


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities, implementing software patches in a timely manner and using other technology to promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Our internal Business Information Security Office ("BISO"), established in 2022, continues to streamline communications between our IT function and business units. The BISO connects several key functions, including the Chief Information Officer Business Partnership, business continuity, governance, risk management, and compliance.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: Our Information Security ("IS") Program consists of policies, procedures and guidelines to ensure the security, availability, and confidentiality of systems and customer information. The IS Program is led by our Information Security Officer ("ISO") under the direction of the Chief Information Officer ("CIO") and is subject to oversight by our IT Steering Committee. The IT Steering Committee is a cross-functional management committee with overall responsibilities for identifying and approving the IT Strategic plan, identifying and approving strategic technology based initiatives that improve/enhance the security posture and mitigation efforts of cybersecurity threats, monitoring of the technology infrastructure and systems, monitoring critical vendors, monitoring cybersecurity threats and issues, and conducting, reviewing, and monitoring IT based risk assessments. These efforts include the framework used to identify and prevent cyberattacks or breaches. The IT Steering Committee makes recommendations for approval of certain risk assessments, risk frameworks, and appropriate application of mitigation strategies and frameworks to the Board of Directors.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Our personnel responsible for cybersecurity proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: cyber incident response, IT disaster recovery, and business continuity plans; cybersecurity assessments and remediation planning as part of our due diligence process; and identity and access management controls.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Our Board oversees and guides our business and oversees our exposure to major risks, including steps taken by management to monitor and mitigate cybersecurity risks. The Board receives and reviews periodic reports from management on various risks, and delegates to its Audit Committee certain oversight responsibilities. The Board monitors cybersecurity risks and receives a report at least quarterly from our CISO regarding our Information Security Program. In addition, certain cybersecurity incidents are escalated to the Board in accordance with our Plan as described above. Periodically, the Board also receives third party assessments of our information security. The Audit Committee receives regular updates on both information security and data privacy matters, and oversees data privacy, integrity, incident and breach risks.

companyName: Elevance Health, Inc.

ticker: ELV


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: Our employees are responsible for complying with our data security standards and are required to complete annual training to understand the behaviors and technical requirements necessary to keep data secure. We also require that cybersecurity training be part of the onboarding process for new hires.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our cybersecurity and risk management program encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. We regularly educate and share best practices with our employees to raise awareness of cybersecurity threats creating a culture where everyone shares responsibility to help protect our sensitive data and information. All employees are regularly provided cybersecurity training and involved in phishing prevention campaigns to raise awareness. Our identity and access management program involves access controls for least privileged access and additional authentication methods. We have many cybersecurity systems including firewalls, intrusion detection systems, continuous monitoring by a full time Security Operation Center to defend against unauthorized access. Incident response exercises are performed using our response and ransomware playbooks ensuring our readiness to response to cybersecurity events. We have a risk management program for our critical third-party vendors focusing on mitigating risks from external sources. Those third-party applications are monitored and access is reviewed including evaluating System and Organization Controls (SOC) reports.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: The board of directors oversees risk management and compliance generally, including information security and cybersecurity. The Audit Committee of our board of directors has primary responsibility for supervising our cybersecurity program on behalf of the board consistent with the requirements of its charter, including with respect to risk management, risk assessment, oversight of management's activities and expertise, and disclosure controls and procedures; however, the full board is briefed regularly throughout the year. As part of the cybersecurity oversight by the Audit Committee and our board of directors, our CAO and CISO provide formal reports to the board (including to all members of the Audit Committee) at least quarterly. These reports include updates on our cyber risks and threats, information security systems, and information security program. In addition, our CAO and CISO also meet directly with members of the Audit Committee and other directors on an ad hoc basis to discuss and seek guidance on our cybersecurity program.

companyName: VERINT SYSTEMS INC


text: Oversight of the ISMS is provided through the ISMS Board chaired by a qualified Chief Information Security Officer (CISO). With representation of the executive management team and board through the Chief Technology Officer, the ISMS collectively makes the primary strategic decision around information security and issues that may arise. All identified risks or incidents are addressed and evaluated by an Information Security Incident Response Team (ISIRT) who are responsible for notifying executive management, board and other internal or external stakeholders as deemed necessary.

companyName: Renalytix plc

ticker: RNLXY


text: Coastal recognizes the critical importance of identifying, assessing and managing material risks from information security threats. One key way that Coastal mitigates information security threats is through the Company's information security program (the "Information Security Program"). Cybersecurity is an integral subset of information security and the Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: The Company has experienced, and may in the future experience, whether directly or through the Company's third-party partners, cybersecurity incidents. While prior incidents have not materially affected the Company's business strategy, results of operations or financial condition, and although the Company's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the Company's business strategy, results of operations or financial condition.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: Cybersecurity Governance Key Information Security risks are overseen by our Security and Technology Risk Committee (the "STRC"), which reports to our Enterprise Risk Management Committee ("ERMC"). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer ("CISO"), provides oversight of mitigation of key risks related to technology and information security. This oversight includes monitoring and approving relevant policies, projects, and programs for the enterprise risk assessments related to technology and information security. The STRC also serves as an escalation point to the ERMC with respect to technology and information security risks. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.

companyName: TransUnion

ticker: TRU


text: We have implemented and we maintain a cybersecurity program that includes a well-defined set of security controls and measures designed to identify, assess, and manage material cybersecurity risks. The cybersecurity program is a part of our broader enterprise risk management program which includes risk assessment, third party risk management, risk mitigation strategy and a clearly defined incident response methodology. The program is led by our executive officers, with support from a working group of senior management with functional and operational expertise. Oversight for this program is provided by the Audit Committee of the Board. Each quarter our executive officers review matters, including any cybersecurity matters, that may present material risks to our strategy, mission or objectives, and where appropriate, engage third parties to conduct assessments of the risks and gaps that require attention. Risk events are classified based on the evaluated likelihood of the risk materializing and its potential impact on the enterprise, and for each material risk a definitive risk mitigation strategy is developed, executed, and shared with the Audit Committee and the Board by our Chief Legal Officer and Corporate Secretary, working closely with our Chief Financial Officer and head of Information Technology, at least quarterly to ensure appropriate monitoring and management of the relevant risks. To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition.

companyName: Anterix Inc.

ticker: ATEX


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies. from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: As of the date of this Annual Report on Form 10-K, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Managing Material Risks and Integrated Overall Risk Management The Company has integrated cybersecurity into our broader risk management framework. Our risk management team works closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. The Company requires the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.

companyName: Matador Resources Co

ticker: MTDR


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders.

companyName: BlueOne Card, Inc.

ticker: BCRD


text: Integration into the Company's overall risk management system or processes To take a holistic perspective on risk, the Company's processes regarding identification, assessment and management of cybersecurity risks are integrated into the Company's overall risk management system and processes. As a result, as examples, the Company's insurance programs, standard and negotiated contract terms with clients and vendors, operational processes, other procedures, and communication protocols in the event of a crisis take into account both cybersecurity threat and non-cybersecurity threat risks, with differentiation based on the nature of the risk.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Wynn Resorts has established a separate committee comprised of the General Counsel, the Chief Financial Officer, the Chief Privacy Counsel, and the CISO. The Materiality Committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: The Zoetis information security team regularly provides an information security dashboard to the Audit Committee, covering the most active and relevant threats to Zoetis, relevant trends, and any notable events. At least twice annually, the Zoetis information security team presents updates to the Audit Committee with respect to the information security program, including the status of our security measures and our efforts to identify and mitigate information security risks. The Audit Committee also regularly reviews certain data privacy and cybersecurity metrics as part of the compliance update presented to the Audit Committee.

companyName: Zoetis Inc.

ticker: ZTS


text: Risk Identification: We maintain an updated inventory of critical digital assets and leverage internal assessments and external threat intelligence to monitor and protect against emerging threats. We conduct periodic scans and audits identify vulnerabilities in our systems.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: We have an internal cybersecurity risk management team consisting of our cybersecurity operations team, cybersecurity engineering team and data privacy and data security compliance team that reports to our Chief Information Security Officer ("CISO"). This team is responsible for identifying and managing cybersecurity threats and assessing and managing material risks from cybersecurity threats.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Our ERM program is designed to identify the top risks applicable to us and document risk mitigation plans and initiatives by management. We have identified, and we expect to continue to identify, cybersecurity threats as among the top risks that we face. As one of the critical elements of our overall ERM approach, our information security program is focused on the following key areas: • Governance: As discussed in more detail below under "Cybersecurity Governance," the Board's oversight of cybersecurity risk management is supported primarily by the Audit Committee of the Board (the "Audit Committee") and our Information and Privacy Risk Committee ("IPRC"), which is the key management-level governance body that oversees management of cybersecurity threat and data privacy risks. • Cross-Functional Approach: Through the IPRC, we have implemented a cross-functional approach to managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of significant cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by appropriate members of management in a timely manner. • Threat Assessment: We engage in an annual cybersecurity-focused risk assessment process, which helps identify our cybersecurity risks by comparing our processes to standards set by the NIST and by engaging third-party experts to attempt to infiltrate our information systems. • Technical Safeguards: While no system is impenetrable, we deploy sophisticated technical safeguards that are intended to provide multiple layers of security designed to identify cybersecurity threats and protect our information systems from such threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and seek to improve through vulnerability assessments and cybersecurity threat intelligence. We leverage both internal and third-party resources to implement and monitor our technical security controls and perform threat and vulnerability assessments. Assessment results feed an iterative process intended to improve our cybersecurity posture and address the constantly evolving threat landscape on an on-going basis. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, processes and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans for critical systems, applications and business functions that address our response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.

companyName: Travel & Leisure Co.

ticker: TNL


text: Our IT Department management team meets monthly to assess and review cybersecurity status, which includes dashboard reviews, operational risks and company compliance. Annually, our internal audit group and third-party consultants meet with our IT Department to perform risk assessment walkthrough meetings, discuss potential enhancements, materiality of risks and alignment with the Center for Internet Security Critical Security Controls framework. In addition, we engage third-party consultants to perform annual red team exercises and external penetration tests.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our management team, which includes our IT management team, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer, Chief of Staff and internal audit function, as needed. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of IT has served in various roles in information technology and information security for over 15 years.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; interruptions to our commercial operations, clinical trials or other operations; harm to our reputation; loss of revenue or profits; loss of sales and other adverse consequences." Our board of directors addresses our cybersecurity risk management as part of its general oversight function.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Governance & Reporting The Board of Directors has designated the Vice President of Information Security as Information Security Officer (ISO). The ISO reports directly to the Senior Vice President of Risk & Compliance and works in tandem with the Chief Information Officer.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: In 2024, we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."

companyName: Pactiv Evergreen Inc.


text: External Assessments The Company's Information Technology and Information Security Departments are examined annually by our financial institution regulator, which includes reviewing our risk management activities to ensure we are properly and adequately managing our risks appropriate to the size and complexity of our business and operations. In addition to annual examinations, the Company's Information Security Program, policies and practices, and cyber posture is subject to regular external independent reviews including annual audits, annual penetration tests, and quarterly third-party cyber risk assessments.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: The Board's Role The Board is responsible for overseeing overall risk management for the Company, including annual or more frequent review and approval of the Enterprise Risk Management approach and processes implemented by management to identify, assess, manage and mitigate risk. The Board has delegated certain responsibilities for oversight of the Company's cybersecurity and information security framework, data protection, cybersecurity, and risk management to the Audit Committee of the Board. Our Board recognizes that cybersecurity protection is vital to maintaining our operations, and the trust of our business and supply chain partners, and of our Share Owners.

companyName: Kimball Electronics, Inc.

ticker: KE


text: The Company's cyber risk management program identifies, tracks, escalates, remediates, and reports risks at the corporate level and across each operating company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to help ensure ongoing mitigation and tracking.

companyName: Veralto Corp

ticker: VLTO


text: The risks related to cybersecurity change rapidly, and we aim to update our information security program as frequently as reasonably possible to achieve commercially accepted levels of preparedness. In addition to the core operating environment of Alarm.com, we also have acquired businesses and subsidiaries that in some cases operate data infrastructure that is distinct from the Alarm.com operating environment, and therefore have distinct data security vulnerabilities. The overall management of cybersecurity risk involves coordination between Alarm.com and our acquired businesses and subsidiaries, and data security risks in these entities may be heightened where the technology platform is less mature than the Alarm.com core platform.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: Our Chief Technology Officer ("CTO") is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Beginning in 2024, our CTO will also provide such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over three years and has over 35 years of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company.

companyName: Biohaven Ltd.

ticker: BHVN


text: At the management level, oversight of risks from cybersecurity threats has been integrated into the Company's overall risk management processes. The Senior Risk Council has broad oversight of the Company's risk management processes, and is also responsible for the assessment and management of risks from cybersecurity threats. The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer; Chief Operating Officer ("COO"); Chief Financial Officer; General Counsel; Treasurer; and CIO, as well as other senior business leaders. The Company believes the experience that these senior management personnel have from serving on the Senior Risk Council provides them with an understanding of the Company's risk management processes overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: We are increasingly dependent on third-party provided software applications and computing infrastructure to conduct key operations. We depend on both our own procured systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the cybersecurity sub-committee. With over a combined 50 years of experience in the field of cybersecurity, the cybersecurity sub-committee brings a wealth of expertise to their role. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our cybersecurity sub-committee oversees our cybersecurity strategies, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: National Storage Affiliates Trust

ticker: NSA


text: We comply with all applicable laws and regulations related to cybersecurity, including data protection and privacy laws.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: Providing operational oversight of IT functions Identify and help plan for improvements to Lightbridge's overall infrastructure Assist with the management of technology vendors Act as a point of contact in emergency/systems down situations and liaison between Lightbridge and Dataprise resources Perform trend analysis and document recommendations to Lightbridge as needed.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Although we have not experienced any material cybersecurity incidents, because of past immaterial cybersecurity threats and incidents, and what we have learned in responding to those threats, we have accelerated multiple cybersecurity program enhancement efforts, including expansion of resources, increased visibility, and stronger protective controls. In 2024, we expect to spend roughly $9 million in maintaining and enhancing our cybersecurity protection efforts. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, for a discussion of risks from cybersecurity threats that could materially affect our business strategy, results of operations, or financial condition, see Item 1A. Risk Factors - "Information technology failures, cybersecurity incidents, or new technology disruptions could have a material adverse effect on our operations" on page 24, which is incorporated by reference into this Item 1C.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: Our CIO has more than 25 years of technology and information systems leadership experience, including as CIO of multiple consumer-focused companies. Our CIO reports to our chief executive officer.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: As part of the above processes, we may engage with assessors, consultants, auditors and other third-parties, including by having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Global Head of IT. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (i) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (ii) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (iii) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (iv) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Management, including the Company's CCO, manages the Company's cybersecurity program, under the supervision of the Company's Audit Committee. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for over 6 years and has worked in the financial services industry for over 25 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: Cybersecurity risks are considered in connection with strategic planning, vendor selection, product development (particularly in embedded control systems), and compliance with regulatory obligations, including export control and data privacy laws.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: We work to identify and address our cybersecurity risks through a comprehensive, cross-functional approach. Key security, risk and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to encourage prompt escalation of certain cybersecurity incidents so that decisions regarding customer and supplier disclosure, public disclosure and reporting of such incidents can be made by management and the board of directors in a timely manner.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Highline has a dedicated specialist who oversees Highline's cybersecurity efforts on behalf of all of its clients. This specialist is responsible for assessing and managing Highline's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity specialist has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Highline.

companyName: GPB Automotive Portfolio, LP


text: Despite our efforts, we acknowledge the potential impact of cyber threats on our operations and business. While the Company has not experienced any significant risks from cyber threats to date, we recognize the potential consequences, including operational disruptions, legal costs, damage to our reputation and financial impacts. We remain vigilant and proactive in managing these risks. We deploy state-of-the-art technologies and services to help us identify and respond to security incidents, manage a 24/7 Security Operations Center and regularly test our preparedness for cyber incidents. These efforts enable us to effectively recognize and respond to low-impact incidents, avoiding their escalation to more problematic situations.

companyName: KENNAMETAL INC

ticker: KMT


text: At UCT, cybersecurity risk management forms a critical component of UCT's overall enterprise risk management program. Led by our Chief Information Security Officer ("CISO"), and under the oversight of our Board of Directors, we have implemented processes to assess, identify, manage and report cybersecurity risks, which, together with our broader business continuity plans, aim to not only address immediate response to cybersecurity incidents but also ensure swift restoration of critical systems and the maintenance of core business functions in the face of digital threats. Our senior management and information technology ("IT") security teams devote considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our management provides operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: SHARING SERVICES GLOBAL Corp


text: We face numerous cybersecurity risks that include cyber-based attacks and other security threats to our systems. We also could be adversely affected by cybersecurity incidents affecting our suppliers and other third-party service providers. To meet these threats, we expend what we consider to be adequate resources on cybersecurity risk management, strategy and governance.

companyName: Ingredion Inc

ticker: INGR


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, our information systems, that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: AppLovin Corp

ticker: APP


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and the data of our partners ("Information Systems and Data").

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Safeguarding the security and integrity of our systems, networks and data is an important element of our business activities. We continually invest in the development and implementation of various cybersecurity programs and processes that are designed to assess, identify and manage material risks from cybersecurity threats and to address the constantly evolving cybersecurity landscape.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity. At least once per year and following any material cybersecurity incidents, the Audit Committee reviews our assessment and management of information security, cybersecurity and technology risks, including the information security and risk management programs and strategies and mitigation strategies. The Audit Committee also reviews the response to data security incidents and breaches as well as the management of third-party cybersecurity risk.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: As of December 31, 2023, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: We have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: Role of Management Through our services agreement with LMC discussed in Item 1 of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and at QVC.

companyName: QVC Group, Inc.

ticker: QVCGA


text: Our commitment to cybersecurity begins at the Board, includes our Audit Committee, and extends to our senior leaders across the company. Our Audit Committee oversees our enterprise risk management process. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management – including in the areas of cybersecurity and other information technology risk and privacy. The Audit Committee performs an annual review of the Company's cybersecurity program and reports to the Board on the results of that review. Material cybersecurity incidents are discussed with our Audit Committee and Board of Directors.

companyName: APi Group Corp

ticker: APG


text: Our cybersecurity program has several fundamental tenants, including security governance, cybersecurity risk management, compliance, defensibility, zero-trust architecture and cloud security. We utilize multilayered defenses and continuous monitoring with data analytics to detect anomalies and search for cyber threats in our system.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight, when and if appropriate. Management provides periodic updates to the Audit Committee regarding cybersecurity matters including significant new cybersecurity threats or incidents, when and if appropriate. We use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: The Company implements cybersecurity policies and controls within acquired entities as part of its integration process over time, typically in a phased approach, and with time periods for full execution varying depending on multiple factors, including the size and geographic scope of the acquired entity's operations; the status of the acquired entity's security including security systems, tools and personnel; security risks within the acquired entity; and the availability and quality of any interim defenses which can be implemented to protect both the Company and the acquired entity or to prevent threats at the acquired entity from reaching the Company's systems. Cybersecurity is also part of the Company's acquisition due diligence to identify risks and interim remedial measures for prioritization and implementation near transaction closing, subject to antitrust rules. In addition to the Company's active monitoring of certain critical third-parties for cybersecurity threats and attacks, the Company also has certain critical third-parties who access its information systems subject to controls designed to mitigate risks from cyber-attacks originating within infected third-party information systems. Moreover, the Company conducts diligence of certain of its third-party service providers with attention to cybersecurity risks.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: Cybersecurity Risk Management Program Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Our cybersecurity risk management program is integrated into our overall risk management system. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our cybersecurity risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, on a periodic basis.

companyName: CoreCivic, Inc.

ticker: CXW


text: Response Readiness and Incident Response Plan – we have developed a comprehensive Incident Response Plan which documents and describes our Cybersecurity Response Readiness and includes detailed procedures to help guide our team members in the event of a Cybersecurity Incident. This includes incident response report templates, which are readily available to document and report to management on incident response activities. The response plan details processes, responsibilities, escalations and other communication channels for reporting, evaluating and responding to cybersecurity incidents. Reporting paths range from addressing an incident within our IT team to escalating incidents to our Audit Committee and to our board of directors, as appropriate.

companyName: Six Flags Entertainment Corp/OLD


text: Chief Information Security Officer. In addition to establishing the ITCC and other committees, we designated a Chief Information Security Officer (CISO) to oversee all aspects of our IS policies, procedures, and controls. Our CISO reports to our Senior Management Committee, the ITCC, the Risk Committee, and the Chairman of the Board. At least annually, the CISO presents all of our IS policies to the Board. The CISO is also tasked with maintaining an effective Security Awareness Program and providing training to our management, Board, and employees on an annual basis. Additionally, the CISO meets with our Audit Committee on a quarterly basis to inform them of material cybersecurity-related regulatory updates and with our full Board on a monthly basis to discuss and provide pertinent regulatory information.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: We engage an experienced cybersecurity consultant as our Interim Information Security Advisor who coordinates our risk assessment processes with our Cybersecurity Steering Committee. We engage an experienced service provider as our 24x7 network and security operations center, to assist us to design and implement our cybersecurity policies and procedures, and to monitor and test our safeguards.

companyName: IGM Biosciences, Inc.


text: Although we have purchased broad form cyber insurance coverage and strive to provide a balanced level of cybersecurity protections, cybersecurity risk has increased due to remote access and increased sophistication of cybersecurity adversaries, as well as the increased frequency of cybersecurity attacks, including malware. As such, information technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers. We cannot be certain that the attacker's capabilities will not compromise our technology protecting information systems or bypass our detection capabilities, including those resulting from ransomware attached to our industrial control systems. If these systems are materially interrupted or damaged by any incident or fail for any extended period of time, then our results of operations could be adversely affected. We may incur remediation costs, increased cybersecurity protection costs, ransom payments, lost revenues resulting from unauthorized use of proprietary information, litigation and legal costs, increased insurance premiums, reputational damage, damage to our competitiveness, and negative impact on our stock price and long-term shareholder value. We may also be required to devote significant management resources and expend significant additional resources to address problems created by any such interruption, damage, or failure. For more information regarding cybersecurity risks, refer to Item 1A. Risk Factors - Information Technology and Cybersecurity Risk Factors on page 23.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: The Company's cybersecurity program is led by the CISO who is responsible for assessing and managing the Company's data privacy function and information security and technology risks, including cybersecurity. The CISO has over 20 years of cyber industry and compliance experience, serving in a CISO capacity for over 10 of those years. The CISO reports to our Chief Digital and Operations Officer, who has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: The company's Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance, and audit readiness. Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our physical and technological cybersecurity controls include, among other items: • perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection; • routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities; • automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems; • multiple mechanisms by which employees can report cybersecurity and data privacy concerns, including a "Report Phish" button in the email application; • a vulnerability management program designed to protect our external and internal networks and critical assets; • bug bounty capability, enabling ethical hackers to simulate real-world attacks to identify and report vulnerabilities; • secure coding and development; and • security and operations framework and tools.

companyName: UNISYS CORP

ticker: UIS


text: Our security teams work with management to prioritize our risk management processes and mitigate cybersecurity threats, including those that may materially impact our business. Our assessment and management of material risks from cybersecurity threats is a key risk area within our enterprise risk management program. Our Chief Information and Data Officer, Chief Information Security Officer, and EVP, Engineering are responsible for management of cybersecurity risk under our enterprise risk management program, and senior management and the audit committee of our board of directors receive reports on the key risks and the effectiveness of our management of such enterprise risks. In addition, key cybersecurity risks are assessed as part of our internal audit program. We have completed various security audits and certifications, including SOC 2 Type II, SOC 1 Type II, PCI-DSS, HITRUST, FedRAMP High, and ISO/IEC 27001. We also employ a shared responsibility model where our customers are responsible for using and configuring our platform in a manner that meets applicable cybersecurity standards. As part of this shared security model, customers have sole responsibility for creating and securing their access credentials for our platform.

companyName: Snowflake Inc.

ticker: SNOW


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The CISO/CIO oversees the overall cybersecurity risk management program, and the Deputy Chief Information Security Officer ("DCISO") has the primary operational responsibilities over our cybersecurity program, including supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO, who is also our CIO, has over 22 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. The CISO/CIO holds a Master of Science degree in computer science and engineering (with a specialization in Information Assurance) and a Doctorate of Engineering Management/Systems Engineering degree. Our DCISO has served in various roles in information security for over 12 years and holds a Certified Information System Security Professional ("CISSP") certification.

companyName: NOVANTA INC

ticker: NOVT


text: While the Board maintains responsibility for risk oversight it has delegated responsibility for evaluating technology and cybersecurity risks to the Audit Committee. The Board reviews the Company's cybersecurity risk posture, strategy and execution on at least an annual basis while the Audit Committee receives cybersecurity updates quarterly.

companyName: Civeo Corp

ticker: CVEO


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operations, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal, and Cybersecurity Risks" within this Annual Report.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Our CISO, in coordination with our Executive Steering Committee, which includes our CEO, our Chief Financial Officer ("CFO"), our Executive Vice President, Engineering, our Senior Director, IT and our General Counsel, works collaboratively across the Company to implement a cybersecurity risk management program intended to protect our information systems from cybersecurity threats and to promptly respond to any Cybersecurity Events in accordance with our incident response and recovery plans. As part of that program, multidisciplinary teams across the Company (both standing, regular teams and special teams as needed) are deployed to provide governance over cybersecurity issues, address cybersecurity threats and to respond to Cybersecurity Events. Through ongoing communications with these teams, our CISO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit Committee, and in certain incidents to the Board, when appropriate.

companyName: PROS Holdings, Inc.


text: awareness training of our employees, incident response personnel, and senior management; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: The risk oversight committee of our board of directors is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our company takes to monitor and mitigate these risks. The risk oversight committee is briefed semi-annually by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. To assist the risk oversight committee, we also have established a security and privacy steering committee comprised of members of senior management and our CISO to oversee data privacy and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in the role since 2019 and has supported the company since 2015.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: We periodically assess and test our cybersecurity policies and practices. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess our cybersecurity measures. As of December 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, although we are unable to provide any assurance that such risks will not become material in the future.

companyName: ON24 INC.

ticker: ONTF


text: Our Board has overall responsibility for risk oversight. Oversight of certain of the Company's key risks is specifically allocated to Board committees based on their respective areas of expertise. The Nominating, Governance and Risk Committee assists the Board in overseeing risks specific to cybersecurity. Pursuant to its written charter, the Nominating, Governance and Risk Committee is charged with overseeing our management's efforts to identify, evaluate and mitigate major risks related to cybersecurity, data protection controls, business continuity/disaster recovery systems and other information security matters, and periodically reviews our approach to the identification, evaluation and mitigation of such risks with the Board. Our Vice President, Information Technology ("VP of IT"), together with our General Counsel, briefs the Nominating, Governance and Risk Committee on cybersecurity risks at selected meetings. These briefings include assessments of the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. To the extent that a significant cybersecurity event occurs, the Nominating, Governance and Risk Committee would also receive periodic updates from senior management, including the VP of IT, the General Counsel, and the relevant Company third-party consultants on any significant cybersecurity events. Such updates would include, as applicable and relevant, the nature, scope and timing of the event; the type and scale of information or data has been accessed, exfiltrated or encrypted; the systems involved; what is known about the threat actor, such as capabilities and demands, if any; management's ongoing assessment of the impacts or likely impacts of the intrusion; the possibility of litigation or regulatory investigations or actions; and any other information that management finds relevant and that would aid in the assessment of the materiality of the impact of the intrusion.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: Cybersecurity Risks As discussed above and under Item 1A. Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: Angi Inc.

ticker: ANGI


text: The Audit Committee provides regular oversight and review of our ERM process and other guidelines and policies governing the processes by which our CEO and senior management assess our exposure to risk, including risk from cybersecurity threats. The Innovation and Cyber Committee receives regular briefings from our CIO, Chief Information Security Officer and other members of senior management on cybersecurity threats and related matters and assists the Audit Committee in its oversight and review of our ERM process.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: We are further enhancing our Cybersecurity Program by implementing an industry-leading third-party security vendor risk management platform. This platform will automate vendor risk assessments and house our Standard Information and Governance (SIG) security questionnaire to streamline vendor procurement and response processes. To augment our internal capabilities, we utilize an outsourced cybersecurity operations center (SOC) for continuous monitoring, investigation coordination, and remediation support.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: We have implemented cybersecurity measures and processes to address and mitigate material risks from cybersecurity threats. We utilize the services of third party providers to develop, maintain, and implement cybersecurity systems and measures designed to protect our information systems from unauthorized access and damage. Our security measures are periodically assessed, tested, and updated. We do not have employees with information technology or cybersecurity expertise and accordingly we obtain an assessment of our cybersecurity systems and measures from a third party provider different from the provider that is primarily responsible for installation, update, and maintenance of information technology and cyber security systems. Our information technology and cybersecurity service providers primarily interface with members of our accounting and finance group. These processes are an integral part of our internal controls and risk management and the results of the third party assessment are reported annually to the Audit Committee along with a report from management on the effectiveness of internal controls.

companyName: Serina Therapeutics, Inc.

ticker: SER


text: As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on our owned and leased networks to conduct our operations, (ii) our transmission of large amounts of data over our systems and (iii) our processing and storage of sensitive customer data. Cyber-attacks on our systems may stem from a variety of sources, including fraud, malice or sabotage on the part of foreign nations, third parties, vendors, or employees and attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing on an annual basis. We also conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures.

companyName: Absci Corp

ticker: ABSI


text: Our cybersecurity incident response process involves a multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders, including if appropriate the audit committee and the board, and keeping them informed and involved as appropriate. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, we have experienced incidents that did not have a material impact on our business or operations, and there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative and detective measures. See "Risk Factors" above for more information about the cybersecurity risks we face.

companyName: Genpact LTD

ticker: G


text: We regularly remind employees of the importance of handling and protecting customer and employee data, including through periodic security training to enhance employee awareness of how to detect and respond to cybersecurity incidents. We also conduct tabletop exercises to simulate response plans to various cybersecurity incidents. Our team of cybersecurity professionals then collaborate with relevant stakeholders within the Company to evaluate and adjust our detection and mitigation strategies.

companyName: ROGERS CORP

ticker: ROG


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For more information about the risks we face from cybersecurity incidents, please refer to Part I, Item 1A. "Risk Factors" of this report, including under the caption "Failure in our information technology and storage systems or our security measures, including without limitation, data breaches, or inadequacy of our business continuity and disaster recovery plans and procedures, could significantly disrupt the operation of our business."

companyName: Eiger BioPharmaceuticals, Inc.


text: The company utilizes active monitoring techniques (e.g., penetration testing), designed to leverage multiple sources of threat intelligence and vulnerability scanning complemented by endpoint protection and network systems. The company has a rapid-response protocol designed to investigate system alerts of potential cybersecurity threats, and the company's incident response plan provides a structured approach to inter-departmental assessment, mitigation, and resolution of cybersecurity threats. The company conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Our management formed an interdepartmental Information Security Council (ISC), comprised of senior executives from multiple disciplines, including our CIO and Vice President of Infrastructure Services, to assess and manage our material risks from cybersecurity threats. The ISC has primary responsibility for our overall cybersecurity risk management program. Our CIO, Vice President of Infrastructure Services, and others within our Information Technology department supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Vice President of Infrastructure Services have a combined 50+ years of experience in information technology, with increasing oversight of cybersecurity responsibilities over the past 20+ years.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We do not retain any confidential information from our customers. While we have control over our information systems, we do not have control over the information systems of our hotel manager, Our Town, or of our franchisors. Although we set expectations for Our Town and our franchisors, we rely on them to manage the cybersecurity risk to which they are subject. Our hotel manager maintains separate cybersecurity insurance coverage to offset a portion of potential costs incurred from a security breach.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we or third-party service providers undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: NETLIST INC

ticker: NLST


text: The Cybersecurity Program is regularly assessed by Morgan Stanley's Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the Board ("BAC") and the BOTC. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by Morgan Stanley's prudential and conduct regulators within the scope of their jurisdiction.

companyName: Ceres Tactical Commodity L.P.


text: In addition, management has worked, and expects to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. Management also conducts periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it complies with and meets current ISO 27001 standards. As part of its cybersecurity program, Teva conducts periodic tabletop exercises to assess its cybersecurity incident response process.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: We had no material cybersecurity incidents in 2024. While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Attacks are increasingly sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Accordingly, risks related to a cybersecurity event, including litigation and enforcement risks, are elevated due to the dynamic nature and sophistication and frequency of these threats, and the expanding use of Internet banking, mobile banking and other technology-based products in our industry. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, Southwest undertakes the following activities: • deploys a defense-in-depth approach with security measures in place at multiple layers; • closely monitors information systems using a suite of technologies and a specialized cybersecurity team; • reviews emerging data protection laws and implements changes to our processes designed for compliance; • trains each new employee who handles individual customer data on handling and use requirements for such data; • avoids, where possible, storing sensitive customer information like social security numbers or banking information for individual customers on our information systems; • conducts regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice, and contracts (as applicable) encourages employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • runs tabletop exercises to simulate response activities to a cybersecurity incident and use the findings to improve our processes and technologies; • leverages the National Institute of Standards and Technology ("NIST") Computer Security Incident Handling Process as a framework to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • conducts vulnerability and penetration assessments, with associated remediation activities.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: we have established and maintain comprehensive incident response plans that fully outlines our response to, and recovery from a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated on an regular basis;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Our cybersecurity program is designed to align with and meet the rigorous standards set by industry frameworks such as NIST, SOC 2 Type 2, and other relevant guidelines. By adhering to these frameworks, we ensure that our security measures are robust, comprehensive, and effective in protecting our systems, data, and operations. This commitment not only helps us maintain compliance with regulatory requirements but also demonstrates our dedication to providing a secure environment for our members, customers, suppliers, employees, and other stakeholders.

companyName: CSP INC /MA/

ticker: CSPI


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we have in the past and also anticipate in the future we will be subject to cybersecurity incidents. We have in place insurance coverage designed to provide coverage in connection with cybersecurity incidents, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; loss of intellectual property or other confidential business information; and other adverse consequences, which may adversely affect our business.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: The governance of our cybersecurity risks involves active and informed participation from our management team, our Audit Committee, and our Board. The Audit Committee, which receives regular updates from the Cybersecurity Committee, maintains oversight of our cybersecurity strategies and risks and will consider such updates as part of the Company's overall risk management program. This oversight includes briefings on the nature of the risks we face, the steps we are taking to mitigate these risks, and any significant cybersecurity incidents that have occurred. In addition, our Vice President of IT will provide reports and updates to the Audit Committee and to the full Board as the need arises. All Board members may attend the meetings of the Audit Committee during which cybersecurity is discussed and will be included in any tabletop exercises as they are planned.

companyName: Celsius Holdings, Inc.

ticker: CELH


text: Associated with Vendors and Other Third Parties periodically conducts risk assessments with vendors and other third parties that have access to the Firm's networks, customer data, and other sensitive information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer has been responsible for the oversight of our cybersecurity since he joined our company in May 2019. He has a B.A. in Computer Science. Our General Counsel has oversight of our legal department, has prior experience serving as inside and outside corporate counsel to technology and cybersecurity companies and a highly regulated cancer diagnostics company.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: During the fiscal year ended December 31, 2024, we incurred $ 302 in response costs related to the incident, including professional services and legal fees, before insurance recoveries. We do not expect to experience material expenses and costs associated with our response to this cybersecurity incident during 2025. No liability for losses has been recorded related to the incident as of December 31, 2024.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Our Head of Security & Privacy or other business leaders provide quarterly updates to the audit committee regarding our company's cybersecurity risks and activities. These updates include any relevant recent cybersecurity incidents and related mitigation and remediation efforts, cybersecurity systems testing, status updates on Security and Privacy team efforts, and the like. Our audit committee provides updates to the board of directors on material cybersecurity risks and activities.

companyName: Lyft, Inc.

ticker: LYFT


text: The Company's cybersecurity risk management program and strategy are designed to ensure the company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management process. Board members receive presentations on cybersecurity topics from management or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: KLA CORP

ticker: KLAC


text: Cyber Risks, Threats and Incidents As a global company servicing customers in over 100 countries, we experience a variety of cybersecurity events and incidents. However, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; though there can be no assurance that a cybersecurity incident that could have a material impact on us will not occur in the future. For further details regarding the cybersecurity risks and uncertainties we face see Item 1A. "Risk Factors-Technology and Cybersecurity Risks" of this report.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Our CISO has more than 20 years of Information Technology and Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 24 years of Information Technology (IT) experience and 17 years of experience in the financial services industry. Our CRO has more than 32 years of experience in Banking and over 14 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with experience in loan servicing and documentation, cash management services, payment operations, information technology, vendor management, and treasury services.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Cybersecurity is an integral component of our business operations and software development practices. We are focused on developing secure cloud-based software solutions, and we recognize the importance of maintaining the confidentiality, integrity, and availability of our information systems and data.

companyName: SafeSpace Global Corp

ticker: SSGC


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition. Such significant cybersecurity incidents include, but are not limited to: • ransomware infiltrating our critical systems resulting in production delays and/or loss of critical information; • cyber theft of our IP; • cyber theft of customer and/or patient information; • cyberattack on a critical partner that disrupts our supply chain and/or services; and, • cyberattacks that significantly impact our brand perception.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: The cybersecurity team monitors and reviews threat intelligence feeds from various sources, including security vendors and U.S. federal and state agencies, to determine potential risks to the companies' information and control systems. Additionally, the team utilizes a defense-in-depth approach to cybersecurity that provides layers of defenses and monitoring/alerting to which the team responds. The team also monitors the companies' third-party service providers for risks related to the confidentiality, availability, and integrity of the companies' data and services hosted through those third parties.

companyName: IDACORP INC

ticker: IDA


text: We design and regularly assess our Information Security Program guided by National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO standards (including ISO 27001), proprietary controls and industry best practices.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: Service and Business Continuity – The Company conducts service continuity exercises and monitors network fault and performance 24 hours a day, 365 days a year to quickly detect and respond to service degradation or impairment. A set of business continuity plans and scenarios are also in place to address catastrophic events to personnel, critical infrastructure, and applications. The Company conducts periodic internal tabletop exercises and joint exercises with customers. Business continuity efforts are overseen by the Company's Business Continuity Committee following policy set by the Company's Security Council.

companyName: CINCINNATI BELL INC


text: Cybersecurity risk management is integrated into our broader risk management framework. The Audit Committee of our Board of Directors, which has responsibility for oversight of risk management, also has responsibility for oversight of our program, policies and procedures related to information security and data protection. On a regular basis, the CIO reports to the Audit Committee of our Board of Directors on cybersecurity risks as well as mitigation strategies and the status of initiatives to strengthen our information security systems. The CIO also provides periodic updates to our full Board of Directors, as appropriate.

companyName: Quanterix Corp

ticker: QTRX


text: Our information security function is led by our Executive Director of Information Technology and supported by the Senior Information Security Manager, our legal team, a management-level Technology Steering Committee, and the Audit Committee of the Board of Directors. This function is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. We employ various methods to monitor and evaluate the threat environment, including automated tools, subscriptions to cybersecurity threat reports and services, analysis of threats reported to us, evaluations of our and our industry's risk profile, threat actor analyses, audits, vulnerability assessments, and tabletop incident response exercises.

companyName: MACROGENICS INC

ticker: MGNX


text: Cybersecurity Incident Response Plan. We maintain a comprehensive incident response plan designed to mitigate the impact of a cybersecurity incident. This plan includes protocols for internal response, external communication, and remediation efforts to minimize the impact on our operations and stakeholders.

companyName: Axe Compute Inc.

ticker: AGPU


text: The Company recognizes the critical importance of developing, implementing, and maintaining effective cybersecurity measures to protect our information systems and provide for the confidentiality, integrity, and availability of our data, as well as that of our customers, business partners and employees. Our cybersecurity processes are integrated into our overall enterprise risk management framework so that cybersecurity risks can be evaluated and managed alongside other business risks. Such integration supports our effort to promote a company-wide culture of cybersecurity risk management.

companyName: IBEX Ltd

ticker: IBEX


text: Review and provide oversight on the policies and procedures of the Company with respect to data privacy, and oversee the Company's compliance with applicable data privacy and cybersecurity laws and regulations; Evaluate the Cybersecurity Committee's composition and performance on an annual basis;

companyName: Cohen & Co Inc.

ticker: COHN


text: Our Board of Directors recognizes the importance of managing risks associated with cybersecurity threats and provides oversight of the Company's information security program. Risk is an integral part of the Board's deliberations throughout the year and the Board exercises its oversight responsibility both directly and through its committees. In particular, the Audit Committee oversees risks relating to information security, including cybersecurity risks. Members of management, including the Company's Chief Information Security Officer ("CISO"), provide the Audit Committee with updates on cybersecurity and information technology matters at least twice a year, and the Audit Committee and management also provide updates to the Board. In addition to reporting to the Audit Committee and Board, the CISO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or the Board, is notified by the CISO of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Cybersecurity risks related to our business, manufacturing operations, clinical trials, privacy and compliance issues are identified and addressed through third party assessments, internal IT audits, IT security, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents we conduct proactive cybersecurity reviews of systems and applications, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: PROKIDNEY CORP.

ticker: PROK


text: Business and Operational Risks • cyber and other security threats or disruptions faced by us, our customers or our suppliers and other partners, and changes in related regulations • the performance and viability of our subcontractors and suppliers and the availability and pricing of raw materials, chemicals, parts and components, particularly with inflationary pressures, increased costs, shortages in labor and financial resources, supply chain disruptions, and extended material lead times • our ability to attract and retain a qualified and talented workforce with the necessary security clearances to meet our performance obligations • our exposure to additional risks as a result of our international business, including risks related to global security, geopolitical and economic factors, misconduct, suppliers, laws and regulations • natural disasters, epidemics, pandemics and similar outbreaks and other significant disruptions • our ability to innovate, develop new products and technologies, progress and benefit from digital transformation and maintain technologies to meet the needs of our customers • products and services we provide related to hazardous and high risk operations, including the production and use of such products, which subject us to various environmental, regulatory, financial, reputational and other risks • our ability appropriately to protect and exploit intellectual property rights

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System or CVSS score, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.

companyName: FNB CORP/PA/

ticker: FNB


text: Process to Access, Identify and Manage Material Risks from Cybersecurity Threats When a cybersecurity incident occurs or we identify a vulnerability, our CIO and our security committee, which is described in more detail under "Governance" above, are responsible for leading the initial risk assessment, and external experts may also be engaged and our Audit Committee or full Board may also be consulted. If a breach of our control structure were to occur, our executive leadership team, Audit Committee and counsel would be briefed by the CIO and a determination would be made on whether such issue is material to warrant disclosure.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. Certain of these systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems.

companyName: Synergy CHC Corp.

ticker: SNYR