text: The Board and management define risk tolerances in the policies of the Company. The Board maintains oversight of risks from cybersecurity related threats, through various committees including the Audit and Risk Committee and the bank's Executive Risk Committee. The CISO reports to the Executive Risk Committee. The CISO provides periodic reports to directors that permit them to measure management's compliance with the defined risk limits and to gauge the changing nature of risk inherent in the Company's chosen lines of business and operations and as a result of changing factors within the Company, such as management and personnel changes, and technology changes. This includes an annual program update to the Executive Risk Committee and the Board. All Board members undergo annual cybersecurity training by third-party cybersecurity experts on cybersecurity threats, industry trends, and other topics relevant to financial institutions. This training and their overall knowledge of the financial industry provides a solid foundation for understanding cyber risk and their oversight responsibility.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD

secItem: Item 1C


text: Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software.

companyName: Sundance Strategies, Inc.

ticker: SUND


text: The Board of Directors oversees the risk management process, while executive leadership implements risk mitigation and cybersecurity strategies. The company's cybersecurity strategy is actively overseen and guided by the Board of Directors through a quarterly subcommittee meeting with the full Board engaged annually. Executive management provides cybersecurity and risk management updates to the Board through the Risk Committee and the Technology Steering Committee. Information Technology knowledge is considered a core competency by eight of fifteen Board members. They guide the full Board in setting cybersecurity objectives, approving policies, and allocating resources.

companyName: MID PENN BANCORP INC

ticker: MPB


text: While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, cybersecurity incidents have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. Cyber Governance.

companyName: CITIZENS, INC.

ticker: CIA


text: Our Senior Director of IT Infrastructure & Security also functions as our information security officer ("ISO"). The ISO (as part of our security function), along with our management committee and broader internal cybersecurity, IT infrastructure, and digital technology automation functions, as well as third-party service providers, all help identify, assess and manage our cybersecurity threats and risks. Our security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, responding to proactive outreach from CISA and FBI, internal and/or external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: To mitigate the financial impact of potential cybersecurity incidents, the Company maintains comprehensive cyber insurance coverage. This coverage is reviewed annually to ensure it aligns with the Company's risk profile and the evolving cyber threat landscape. In addition to covering losses associated with an incident, this insurance coverage also provides for additional access to third-party resources and expertise to augment Buckle resources should a cyber incident occur.

companyName: BUCKLE INC

ticker: BKE


text: Leaders in Management The Company's IT strategy and implementation is overseen by a dedicated Chief Information Officer with over 20 years of experience in the field, including previously serving a 17-year tenure, most recently as Vice President of Global IT, with a global technology leader of fiber optic subsystems and components. He holds a Bachelor of Science in Computer Science and Engineering from Andhra University in India and an MBA from the Indian School of Business. In addition, the Company has recently engaged a Chief Information Security Officer ("CISO"). The Company's CISO has built and managed world-class information security programs and technology teams for industry leading global companies. She has deep experience securing healthcare-focused companies in both the provider and supplier space. She holds a Bachelor of Science from the University of Redlands and an MBA from Notre Dame De Namur University along with holding certified information systems security professional ("CISSP") and certified information security manager ("CISM") certifications.

companyName: OMNICELL, INC.

ticker: OMCL


text: It is our organization's aim to comply with all cybersecurity and data privacy laws and regulations in applicable jurisdictions. Additionally, we are committed to meeting national and international standards and best practices for our industry for effective cybersecurity risk management of the organization's confidential information and critical IT infrastructure. Our cybersecurity and data protection policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or "NIST", and other applicable industry standards and frameworks such as HITRUST and SOC 2. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the data that we collect and store, and information systems and technologies through which that data is processed, by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents when they occur. Our organization's internal administrative, technical, and physical security measures (controls) are tested for compliance to these frameworks and reviewed annually. The domains and controls associated with these frameworks are tested and reviewed annually. Certifications of compliance, and/or Auditor's 'Letters of Opinion' Attestation of Compliance from the applicable auditors are provided once the audits are completed each year.

companyName: Hyperfine, Inc.

ticker: HYPR


text: The company has not experienced a cyber security incident or a cyber security threat during 2023 nor in any prior years. The company's overall risk management systems and processes have followed the recommended guidelines of our cyber security insurance company. The Audit Committee has the board's oversight of risk from cyber security threats and the responsibility for reviewing the management processes. Management's role in assessing and managing material risks from cyber security threats is the responsibility of the Chief Financial Officer, who reports and coordinates any potential material risk to the Audit Committee.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: For specific technical expertise, management leverages and consults with our external information technology consultants to advise on threat identification, prevention, and other cybersecurity matters. In the event of a cybersecurity incident, management would be responsible for implementing response procedures and reporting the matter to the Board of Directors.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Item 1A, Risk Factors."

companyName: Septerna, Inc.

ticker: SEPN


text: The material cybersecurity threats identified through these processes are managed by our CISO and, where appropriate, our risk and compliance committee, in consultation with management. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.

companyName: Snap Inc

ticker: SNAP


text: To respond to the threat of security breaches and cyberattacks, we have developed a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats to all information and systems owned by us. We maintain certain risk management processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impacts to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our information systems and the information residing therein.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: Although since inception, we have not experienced a material information security breach incident, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the JFG and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors - Risk Related to our Business - Cybersecurity risks and cyber incidents may adversely affect our business or the business of our Portfolio Companies by causing a disruption to our operations or the operations of our Portfolio Companies, a compromise or corruption of our confidential information or the confidential information of our Portfolio Companies and/or damage to our business relationships or the business relationships of our Portfolio Companies, all of which could negatively impact the business, financial condition and operating results of us or our Portfolio Companies" in this annual report.

companyName: Senior Credit Investments, LLC


text: The CISO and Director of Security Operations has worked in the information security field for over 15 years and holds an undergraduate degree in computer systems management and master's degrees in both cybersecurity and technology management. He has also attained multiple cybersecurity-related professional certifications and licenses, including Certified Information Systems Security Professional, and is an adjunct professor of cybersecurity at New York University and Fordham University. The CTO holds a master's degree in microengineering and has served in various leadership roles in computer engineering for more than 20 years.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: Our information security program is led by our CISO, who is responsible for the overall security of the enterprise, and our Security & Resiliency global practice leader, who is responsible for the security of the services that we provide to customers. Our CISO and Security & Resiliency global practice leader collaborate closely with one another and other key stakeholders across the Company in developing and implementing our cybersecurity strategy, policy, controls, operations, threat detection and incident response and remediation. Our teams that support the CISO and Security & Resiliency global practice leader in these efforts are comprised of cybersecurity professionals with many years of experience in cybersecurity across multiple sectors, including heavily regulated industries such as financial services and defense, and many of them hold relevant industry certifications.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: We have also implemented procedures set forth in our cybersecurity policy that secure sensitive data in our possession, which include: • Establishing policies governing data security; • Monitoring data access throughout the organization; • Providing annual security training and awareness; • Protecting sensitive data through encryption techniques; and • Designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Our board level audit committee retains oversight of our cyber security program, which is led by our vice president of information technology services. Our senior leadership regularly provides updates on cybersecurity risks and cyber security initiatives to both the audit committee and the broader board. The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology (IT) department, we have an Information Security (IS) department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer (CTO) who has an undergraduate degree in network and systems administration as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.

companyName: Installed Building Products, Inc.

ticker: IBP


text: The Board is responsible for general oversight of our risk management, including cybersecurity risk. The Audit and Finance Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures. Cybersecurity reviews are conducted at least quarterly and reported to the Board or the Audit and Finance Committee by the CISO and/or Chief Financial Officer at least quarterly.

companyName: PENTAIR plc

ticker: PNR


text: Our CIO has 30 years of experience in highly regulated industries managing information security in complex, matrixed environments, seven of which are in his current role with the Company. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.

companyName: PBF Energy Inc.

ticker: PBF


text: Our CIO, who reports directly to the CEO, has significant professional experience including senior technical leadership roles at public companies and maintains the certified information systems security professional (CISSP) certification. Under the direction of the CIO, our information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks and conducts regular enterprise-wide training on cybersecurity threats for all employees. This analysis drives our long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the department and are communicated to the board of directors regularly.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. To address the significance of these threats to our operations, customers and stockholders, we have established oversight mechanisms to ensure effective management, oversight and governance in managing risks associated with cybersecurity threats.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company's broader enterprise risk management function. At each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established tolerances of each risk metric as well as the assessment of the direction such metric is trending. These metric reports give the ERM Committee a broad view of the aggregate cybersecurity risk that the Company faces at any particular time, insight into any particular areas of risk as well as an opportunity for the ERM Committee to discuss with management the steps taken or to be taken to address risks that are out of tolerance or trending in that direction. In addition to this report, the CISO's report to the Technology Committee is included the materials for ERM meetings. The chair of the Technology Committee is a member of the ERM Committee, enabling the chair to convey to the ERM Committee details of the discussions with respect to the CISO's report as well as other matters related to our technological infrastructure and the impact thereof on matters within the ERM Committee's focus. Finally, at each ERM Committee meeting our Chief Technology Officer addresses various information technology topics with the ERM Committee.

companyName: RENASANT CORP

ticker: RNST


text: Our internal cybersecurity testing and reporting processes allow us to rank our overall risk on a periodic basis to ensure we identify and respond to internal risk trends. We follow escalation procedures to ensure communication of cyber-related events. The Board and management have made cybersecurity education and training a part of our overall corporate objectives, setting the tone for the organization about the importance of cybersecurity.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: We utilize a defense-in-depth approach, layering security starting with cloud-based tools through our perimeter all the way to the client and server end points with End Point Detection and Response solutions. We continue to invest and align advances in technology to strengthen our security posture. This year, for example, we implemented additional protections against phishing attacks by utilizing artificial intelligence to further strengthen our defense. Cyber risks and incidents are categorized by severity, evaluated for materiality, responded to based on defined incident response playbooks and then remediated accordingly. We perform organized tabletop exercises to test these practices and identify areas where opportunities for improvement can occur.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.

companyName: Tradewinds Universal

ticker: TRWD


text: Our board of directors has approved management committees including the Information Technology Risk Committee, which focuses on technology impact, and the Information Security Oversight Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the enterprise information security department and include the Chief Information Security Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet monthly (in the case of the Information Technology Risk Committee) and quarterly (in the case of the Information Security Oversight Committee) to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Together, our Vice President of IT and Digital and CISO lead a dynamic, cross-functional team that includes relevant stakeholders from all Company divisions. This team plays a pivotal role in raising cybersecurity awareness throughout the Company, ensuring that every employee is informed and cautious about potential cyber threats. They are committed to keeping our Company's management and Board regularly informed on cybersecurity matters, ensuring transparency and proactive management of digital risks. Additionally, they actively collaborate with division managers, participating in divisional management meetings to identify and protect sensitive information. Their involvement at this level ensures that cybersecurity is integrated into every aspect of our operations, aligning with our broader strategic objectives.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Our cybersecurity risk processes address risks associated with our use of third-party service providers, including subcontractors used by those third-parties. Third-party risks are included within our GRC and procurement program, including the selection and oversight of our third-party service providers.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Corporate Governance Our Board of Directors has overall responsibility for risk oversight and has delegated the oversight of risks associated with cybersecurity to the Audit Committee. The Audit Committee reports to the Board on our cybersecurity risk management practices and performance, generally on a quarterly basis. The Audit Committee receives reports from senior members of management, including from each of our Chief Information Officers ("CIOs") (which include the CIO of each of our principal operating companies: Lawson, TestEquity and Gexpro Services), and the internal audit department regarding the cybersecurity risk management program. Among other things, these reports have focused on the following: • recent cyber risk and cybersecurity developments; • cyber risk governance and oversight; • assessments by third-party experts; • key cyber risk metrics and activities; and • major projects and initiatives.

companyName: Distribution Solutions Group, Inc.

ticker: DSGR


text: Responsibility for cybersecurity matters sits within the Chief Security Office, where it forms the first Line of Defense within Deutsche Bank's Three Lines of Defense model. The Chief Security Officer has delegated authority from the Deutsche Bank Management Board ("Management Board") and reports directly to the Chief Technology, Data, and Innovation Officer, who is a member of the Management Board.

companyName: RREEF Property Trust, Inc.


text: The CISO brings nearly two decades of cybersecurity experience to their work at Verizon. Prior to joining Verizon, they held executive-level cybersecurity roles at other large public companies, where they were responsible for cybersecurity strategy and operations, including incident response, threat intelligence, security services, architecture, commercial operational technology security, and regulatory and compliance matters.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Our Board oversees the risk management activities designed and implemented by our management. Our Board executes its oversight responsibility both directly and through its committees, and has delegated the responsibility of providing oversight of cybersecurity risks to its Audit Committee, including oversight over the steps management takes to monitor and control such exposures. Our Senior Vice President of Product and external cybersecurity professionals are responsible for overseeing, managing and assessing material cybersecurity risks, and periodically report to the Audit Committee on the ongoing development, status and health of our cybersecurity program and material cybersecurity risks or incidents, if any.

companyName: Leafly Holdings, Inc. /DE


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information and maintaining operational resilience. We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: Our Information Security and Information Technology teams manage and monitor our cybersecurity environment. These teams track cybersecurity incidents across Gap Inc., our vendors and third-party service providers to remediate and resolve incidents. Incidents are escalated as appropriate based on a risk assessment framework, including as needed to senior management. Gap Inc.'s Privacy team is involved to the extent data privacy concerns are implicated. We maintain an incident response plan to coordinate activities taken to respond to and remediate cybersecurity incidents. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and senior management makes final materiality determination and disclosure decisions.

companyName: GAP INC

ticker: GAP


text: Our policies and procedures define an overall, enterprise-wide approach for managing information security and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Privacy and Security Subcommittee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Our operating businesses are managed on an unusually decentralized basis. There are few centralized or integrated business functions. Consistent with our decentralized management philosophy, our operating businesses individually establish specific practices concerning cybersecurity risks. Although our subsidiaries have taken steps intended to mitigate these risks, including business continuity planning, disaster recovery planning, and business impact analysis, a significant disruption or cyber intrusion at one or more of our significant operations could adversely affect our results of operations, financial condition, and liquidity. Additionally, if we are unable to acquire, develop, implement, adopt, or protect rights around new technology, we may suffer a competitive disadvantage, which could also have an adverse effect on our results of operations and financial condition. Given the wide variations in the nature and size of business activities, specific practices may vary widely among our operating subsidiaries.

companyName: Biglari Holdings Inc.

ticker: BH-A


text: Program Assessment. We continuously evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of our systems and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements, and assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the Defense Contract Management Agency (DCMA) and Cybersecurity Maturity Model Certification Third-Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.

companyName: RTX Corp

ticker: RTX


text: We are a global bioscience company dedicated to healthy aging. In the ordinary course of our business, we may collect, process, store and transmit proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties. We use our data centers and our networks, and those of third parties, to store and access our proprietary business and other sensitive information. We rely upon third parties service providers and technologies to operate critical business systems to process confidential and personal information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, and other functions. We have established cybersecurity risk management policies and procedures aimed at safeguarding the confidentiality, integrity, and availability of our critical systems and information, including those involving third-party service providers. Further, we are actively working to enhance our policies and procedures into a more comprehensive cybersecurity risk management program, our current measures are designed to address cybersecurity risks effectively. Our cybersecurity risk management policies and procedures include the Incident Management Plan.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: The Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: CARGO Therapeutics, Inc.


text: We are subject to various cybersecurity risks in connection with our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors, I. Risks Related to Our Business Operations and Industry of this Annual Report.

companyName: PTC INC.

ticker: PTC


text: The Company's Board of Directors and management have discussions to stay vigilant and engaged as it relates to cyber exposures, risk management strategy, monitoring, and cyber-incident response and recovery plans. Members of the Board of Directors have access to, and relationships with, cybersecurity experts in the organization, including the Company's Head of Information Technology, who has extensive experience in network operations and an understanding of cybersecurity. Additionally, as the dynamic cybersecurity environment is continuously evolving, management has periodic meetings with our cybersecurity insurance providers to reevaluate the Company's cybersecurity risks and related information technology resiliency. The Board of Directors shall be informed of any material information technology breaches that the Company has experienced in a timely manner.

companyName: WILLIS LEASE FINANCE CORP

ticker: WLFC


text: Our Board of Directors retains responsibility for evaluating key business risks faced by the Company, including but not limited to information security. In part, our Board of Directors addresses its general oversight function by delegating the Company's cybersecurity risk management to the Audit Committee. The Audit Committee's responsibilities include supervising risk mitigation efforts related to cybersecurity threats, evaluating the sufficiency and effectiveness of information security policies and practices, and ensuring robust internal controls for information security.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We incorporate the lessons learned from these engagements into our cybersecurity program. Our cybersecurity program also includes controls to manage risks associated with our use of third-party service providers; however, we cannot ensure in all circumstances that their defensive efforts will be successful.

companyName: POOL CORP

ticker: POOL


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) cybersecurity framework. Our cybersecurity operations team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile. We use various methods and security tools designed to help prevent, identify, protect, detect, escalate, respond, and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: The ISO conducts training on cybersecurity risks for all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology.

companyName: ENB Financial Corp

ticker: ENBP


text: The Company uses various tools to prevent, detect, and mitigate cybersecurity incidents. The Company has procedures in place to respond to cybersecurity incidents, which include prompt meeting of the Cybersecurity Incident Disclosure Committee, a Company management committee, to assess cybersecurity incidents and determine materiality requiring disclosure on Form 8-K, notification of the Board of any material cybersecurity incidents, quarterly reporting by the Chief Information Security Officer of material and non-material incidents to the Risk Oversight Committee and management, and to the Audit Committee of such incidents related to the Company's financial systems.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by ensuring that activities on our systems and applications are logged and monitored. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to ensure that vulnerabilities don't materialize through minimizing system ports, protocols, and services to only that which is necessary.

companyName: NELNET INC

ticker: NNI


text: IT security, cybercrime, privacy, and HIPAA security training provided to employees and independent review of disaster preparedness, incident response, and business continuity plans with cybersecurity intend to continue to leverage the support of third-party information technology and security providers, including to perform risk assessments designed to identify, assess, and manage cybersecurity risks. We assess on an ad-hoc basis the data protection practices of certain of our third-party vendors who handle our data, which assessments include the assessment of vendor data protection policies, disclosure of changes to data protection policies or practices, maintenance of cyber liability insurance, and provision of certifications, assessments, or other documentation as deemed relevant.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: a third-party risk management program that evaluates and ensures our key partners adhere to the same level of information security posture as we do internally;

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, the Company, and our service providers, may be unable to provide our products or services for the duration of the event and/or a time thereafter.

companyName: SKYX Platforms Corp.

ticker: SKYX


text: Our management team, including the VP of Enterprise Security & Compliance and Director of Enterprise Security & Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's collective experience includes a diverse background in fintech and other industries, with decades of experience in various aspects of cybersecurity.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation. We have tools and protocols in place designed to prevent, detect and escalate security incidents within the Company.

companyName: OOMA INC

ticker: OOMA


text: We conduct periodic and ad-hoc risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: HARMONIC INC.

ticker: HLIT


text: Conditional Access Policy (CAP): Rejects connections to Exchange Online from un-authorized countries. We are further enhancing this control by implementing ACL's (access lists) in our CRM and ERP systems and any other mission critical platform. ALL platforms should have MFA enforced, any platform not supporting MFA in 2024 is deemed high-risk and immediately replaced as it is obsolete and poses high-risk to the Company.

companyName: Stemtech Corp

ticker: STEK


text: We employ a cybersecurity program which we believe is appropriate for the potential of cybersecurity threats faced by us and is built upon a set of policies, procedures and standards supported by training and education Our information systems employ local and cloud storage and recovery services from various third parties. We have engaged third-party consultants to assess and gather threat intelligence and cyber risk trends and conduct assessments and testing of our cybersecurity procedures and protections.

companyName: FEMASYS INC

ticker: FEMY


text: Board Oversight—Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CIO and the CISO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews the company's cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. Cecil D. Haney, a member of the audit committee, brings to the board valuable insights into cybersecurity, systems planning, and crisis and risk management. In addition to regular updates to the audit committee, we have protocols by which certain cybersecurity incidents are escalated within the company and, where appropriate, reported in a timely manner to the board and the audit committee.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: The CISO and VP of Cybersecurity report cybersecurity incidents to members of the company's senior management, including the Cybersecurity Council, CIO, CEO, and the Board of Directors based on the severity and type of the incident to ensure proper external reporting is completed thoroughly and timely. Pursuant to its charter, the Cybersecurity Committee of our Board of Directors is responsible for reviewing, discussing, and making recommendations to the full board regarding cybersecurity matters. Our CIO, CISO, and VP of Cybersecurity provide presentations to the Cybersecurity Committee on our cybersecurity program at each of the committee's regularly scheduled quarterly meetings. These briefings include assessments of the cyber risk and threats landscape, updates on incidents, policies and procedures, and our investments and plans in cybersecurity risk mitigation and governance. The Cybersecurity Committee also meets with members of the Cybersecurity Council to discuss various aspects of our cybersecurity program between regular meetings. All members of the Board of Directors are invited to attend all meetings of the Cybersecurity Committee, and the committee regularly briefs the entire board regarding their oversight of our cybersecurity program.

companyName: AeroVironment Inc

ticker: AVAV


text: Preventive Controls: We deploy advanced firewalls, endpoint protection and intrusion detection systems to secure our network infrastructure. Multi-factor authentication and encryption are enforced across critical systems and data repositories. Monitoring and Detection: Continuous monitoring of our IT environment is facilitated through our third -party service provider. Incident Response: We maintain an incident response plan that outlines procedures for containment, eradication, and recovery from cybersecurity incidents.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cyber and data security threats. Members of the Board or Audit Committee receive periodic updates from senior management regarding our cybersecurity processes and risks. Members of management that comprise our incident response team include the following officers (or those with similar responsibility): Senior Director of Information Technology, Vice President of Engineering, Chief Financial Officer, General Counsel, Customer Success (if customer data is affected), and Vice President of Human Resources (if employee data is affected). As part of our internal response policy, upon confirmation of a breach, a remediation process is initiated, led by our Principal Privacy Officer who chairs an incident response team. This team may include members from relevant departments such as Product Development, Information Technology, Finance, Legal, Marketing, Client/Customer Services and Human Resources, any other relevant units or departments affected by the breach and any additional personnel as deemed necessary.

companyName: AUDIOEYE INC

ticker: AEYE


text: The Company has a dedicated CIO and an Information Security Director who are supported by a team of cybersecurity professionals (the "Cybersecurity Team") that are responsible for leading the company-wide cybersecurity program and risk mitigation efforts. The CIO, the Information Security Director, and Cybersecurity Team work across all organizations within the Company to protect the Company and its employees, customers and suppliers against cybersecurity risks. The CIO and Information Security Director, with over 35 and 25 years of experience, respectively, have cybersecurity expertise, coupled with experience in IT strategy, operational management, incident response, and business continuity maintenance.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Recognizing the critical role of human factors in cybersecurity, we implement comprehensive education and awareness programs for all employees. These programs are designed to promote safe online practices and encourage prompt incident reporting. Additionally, we conduct phishing simulations and other exercises to measure and improve our employees' ability to recognize and respond to cyber threats effectively.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Company websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company's cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by a team of senior level management, including our President, Chief Executive Officer and Chairman of the Board, Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Secretary, and VP of Information Technology. Such individuals collectively have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: o Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.

companyName: BlackRock Direct Lending Corp.


text: We have engaged, and expect to continue to engage, consultants, or other third parties in connection with our risk assessment processes. These providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing the design of our processes. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers we expect them to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.

companyName: RxSight, Inc.

ticker: RXST


text: Prospect Capital Management conducts regular phishing tests in which educational materials are provided in each test for those who fail. Prospect Capital Management is implementing security awareness training which will be conducted annually for staff with a high failure rate on the phishing tests.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: Management is responsible for the day-to-day administration of the Company's risk exposures and has adopted a risk management framework including identification, analysis and response to risks affecting our business.

companyName: Resonate Blends, Inc.

ticker: KOAN


text: Our cyber risk management program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity risks are identified and addressed through a comprehensive, cross- functional approach. The Company has established a cybersecurity committee consisting of members of senior management, including the Company's Chief Information Security Officer ("CISO"). The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO has over 25 years of information technology and cybersecurity experience. He holds the title of Senior Vice President of Technology Services and Chief Information Security Officer, has been in his role since 2021 and is supported by his direct reports and their teams. The cybersecurity committee also includes senior members from the Company's legal, human resources, technology, communications and risk management departments. This committee meets on a periodic basis to review various cybersecurity and data privacy matters and is responsible for maintaining processes to assess, identify and manage material risks from cybersecurity threats. The cybersecurity committee provides quarterly updates to the Company's General Counsel, Chief Financial Officer and Executive Vice President of Global Media Operations and Technology. In addition, the cybersecurity committee has established regional triage teams that are responsible for responding to any cybersecurity incident and deciding if other members of the cybersecurity committee, Company employees or Company vendors should be involved in the Company's response.

companyName: AMC Networks Inc.

ticker: AMCX


text: Our cybersecurity risk management program incorporates a variety of methods to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including: • risk assessments designed to help identify cybersecurity risks to our Information Systems and Data; • a team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • annual training of our employees at all levels and in all departments regarding cybersecurity awareness and protection of confidential information; and • a cybersecurity incident response plan that includes procedures for detecting and responding to cybersecurity incidents.

companyName: SITIME Corp

ticker: SITM


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.

companyName: J.Jill, Inc.

ticker: JILL


text: Emerson relies on third-party service providers for certain critical or key infrastructure, solutions, and services across our operations. Emerson has an internal vendor management team that assesses risks from vendors and suppliers that provide, amongst other things, key information and supply chain services to Emerson.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: Certifications of our cybersecurity professionals include, but are not limited to: Certified Information Systems Security Professionals from the International Information System Security Certification Consortium; Certified Information Security Manager from Information Systems Audit and Control Association; and focused training/certifications from security vendors on the applications utilized in the management of our cybersecurity program. The certifications mentioned above are accompanied by multiple years of direct experience in cybersecurity which provide the framework for the team's continuous learning of new technologies, processes, trends, and concepts, with additional training obtained through relevant cybersecurity focused conferences.

companyName: Invitation Homes Inc.

ticker: INVH


text: Our Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our CISO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, penetration testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our CISO and our third-party cybersecurity consultant to review our cybersecurity strategy and the results of our NIST CSF assessment. In accordance with our cybersecurity incident response plan, our Board is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: We have also implemented a well-established incident response plan to address cybersecurity threats and incidents related to operational risk, intellectual property theft, reputational risks, fraud and extortion, harm to the personal identifying data of employees or customers, violations of laws, and other risks, including procedures for (i) detection and analysis, (ii) containment and eradication, (iii) remediation and (iv) preparation for future incidents. These processes are aligned with standard industry frameworks, such as the National Institute of Standards and Technology, Committee of Sponsoring Organizations and International Organization for Standardization 27001, and other industry standards.

companyName: Liquidia Corp

ticker: LQDA


text: We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks and which is integrated into our larger enterprise-wide risk management program. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security penetration testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity. Third-parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional contractual controls.

companyName: REPLIGEN CORP

ticker: RGEN


text: We have established processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we use or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into the overall risk management system through the use of firewalls, antivirus and malware detection, and other security software. The processes include efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. We have engaged consultants to assist us with risk mitigation and monitoring threats from both inside and outside our network, including risks of cybersecurity threats associated with the use of third-party service providers. We maintain full backups on a regular basis to protect against the loss of critical data.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: Primary responsibility for assessing, monitoring, and managing cybersecurity risks rests with the CIO, who has oversight over the IT Department, including one dedicated cybersecurity staff person and select specialized contractors. This group of contractors includes a Chief Information Security Officer, IT Director, Cybersecurity Analysts, Network Engineers, and Network Administrators. The CIO, Chief Information Security Officer, and IT Director all have a minimum of ten years of experience in the cybersecurity and technology leadership field.

companyName: YORK WATER CO

ticker: YORW


text: Our industry has become increasingly dependent on digital technologies to conduct certain processing activities. For example, we depend on digital technologies to perform many of our services and to process and record financial and operating data. We recognize the importance of assessing and managing material risks associated with cybersecurity threats. We seek to assess, identify and manage cybersecurity risks for our IT environment, leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), through the processes described below: Risk Assessment:

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a process to review the cybersecurity risk profile and operational criticality of the key service providers and to seek appropriate contractual cybersecurity protections.

companyName: ARCH RESOURCES, INC.


text: The board and the risk committee receive regular presentations and reports from management as well as outside experts on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. On an annual basis, the board and the risk committee discuss our approach to cybersecurity risk management with our Chief Risk Officer, Chief Compliance Officer and Chief Information Officer, among others. At each regular board meeting, the risk committee reviews and reports to the board on key cybersecurity risks. The board and the risk committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: FISERV INC

ticker: FISV


text: Our information technology ("IT") and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Vice President of Information Technology ("VP IT") is responsible for establishing, implementing, and executing our cybersecurity program and strategy. Our VP IT has more than 25 years of IT, IT audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques. All IT staff are obliged to include cybersecurity as part of their everyday considerations and tasks.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including but not limited to the following risks: operational, regulatory compliance, reputational, strategic, information technology, data security and privacy, and market risks such as interest rate, credit, liquidity and price risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Board of Directors is responsible for risk oversight over all significant risks facing the Corporation and fulfills this responsibility mainly through its committees. While our Board of Directors takes an oversight role in cybersecurity risk tolerance, we rely to a large degree on management and outside consultants in overseeing cybersecurity risk management. Our Director of Information Security, who reports directly to our Chief Information Officer, is primarily responsible for this cybersecurity component and is a member of management's Operational Risk and IT Steering Committees, and regularly attends and presents to the Risk Committee of our Board of Directors ("Risk Committee").

companyName: FIRST OF LONG ISLAND CORP


text: As previously discussed in "Item 1. Business" the Partnership is managed by GPB, through its affiliation with Highline under supervision and direction of the Receiver. Among the services provided to the Partnership under the MSA is a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program was integrated within the Partnership's enterprise risk management system as administered and overseen by Highline under supervision and direction of the Receiver and addresses the corporate information technology environment.

companyName: GPB Automotive Portfolio, LP


text: The cybersecurity risk management and strategy processes are overseen by the Sponsor's cybersecurity committee which consists of the Company's chief financial officer and general counsel, and the CTO, legal, risk management, and compliance teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, and compliance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: CNL Strategic Capital, LLC


text: We take a holistic approach to identification, mitigation and management of cybersecurity and data risks through governance and compliance processes integrated across our Cyber program and our C&E program. These processes include integrated policies, risk assessments, impact assessments, third party reviews and monitoring, incident response, and external certification programs such as ISO 27001: Information Security Management Systems, ISO 27701: Privacy Information Management Systems, and APEC Cross-Border Privacy Rules System. We recognize that our first line of defense is our employees and we incorporate cybersecurity awareness education in our annual Code of Conduct and Ethics training program to ensure our employees understand their roles in safeguarding against potential cyber threats.

companyName: Dun & Bradstreet Holdings, Inc.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our board of directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, including the Company's risk profile and exposures as they relate to cybersecurity, conducting reviews of policies regarding risk assessment and risk management and major risk exposures, as well as evaluations of risks from potential or actual cybersecurity threats. Our Chief Information Officer, Vice President of Infrastructure, and Security Administrator have responsibility of cybersecurity oversight of the Company and each have 13, 16, and 7 years of cybersecurity experience, respectively. The Security Administrator reports to the Vice President of Infrastructure, who in turn reports to the Chief Information Officer. Members of the Board receive regular quarterly cybersecurity updates from our Chief Information Officer, including updates on existing and new cybersecurity risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: Risk-Based Controls for Information Systems: We maintain an Information Technology (IT) infrastructure with physical, administrative, and technical controls tailored to protect the confidentiality, integrity, and availability of our information and systems.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We have a Third-Party Risk Management ("TPRM") Program that includes the comprehensive evaluation of the cybersecurity risks of prospective and existing third-party relationships. The TPRM Program utilizes a risk-based approach to perform ongoing due diligence reviews of existing third-party relationships and new prospective third parties. Third-party risks are identified and evaluated in coordination with period reviews, although threat intelligence monitoring and sound vendor relationships are leveraged to identify third-party risks as announced. TPRM is a function of our Risk Organization overseen by the Chief Risk Officer ("CRO").

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our Chief Information Security Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee reports to the Board on cybersecurity risks and other matters reviewed by the Committee. In addition, the Board receives separate presentations on cybersecurity risk. Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: As part of our enterprise risk management, we maintain a comprehensive cybersecurity program that proactively monitors, assesses, identifies, mitigates and responds to cybersecurity threats, including threats relating to disruption of business operations or financial reporting systems, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal and reputational risks, and that emphasizes governance and compliance. Our cybersecurity program and related cybersecurity policies are reviewed annually.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third-parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity incidents to identify and mitigate risks to us from third-party incidents. We also carry business interruption insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: We maintain physical, technical and administrative safeguards to prevent and identify cybersecurity risks, and have implemented practices and procedures to address cybersecurity risks. To this end, among other things, we: provide annual mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: CorMedix Inc.

ticker: CRMD


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: HPS Corporate Lending Fund


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risk is generally integrated into our overall risk management systems and processes. The Company's internal audit function, with primary oversight by the Audit Committee, assesses key risks facing the organization across functions and regions. These risks are reviewed and discussed by the Company's management-level risk committee, which is a multi-disciplinary committee including representation from senior management in the finance, internal audit, and legal functions, among others. The risk committee is tasked with ensuring risks, including those related to cybersecurity, are managed and aligning strategic objectives with an appropriate level of risk tolerance.

companyName: Booking Holdings Inc.

ticker: BKNG


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K • regular cybersecurity training programs for employees and management; and annual cybersecurity management training for employees involved in our systems and processes that handle sensitive data; • leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice, and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat sensitive information with care; • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • maintaining a risk management program for suppliers, vendors, and other third parties, which includes conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed. These approaches vary in maturity across the business, and we work to continually improve them.

companyName: BioAtla, Inc.

ticker: BCAB


text: Vulnerability/patch reporting for end points on the Bank's network In addition to our regularly scheduled Board meetings, the General Counsel and CRO, the SVP, Information Technology, the vCISO and the CEO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Rhinebeck Bank. The Board of Directors closely reviews the annual vCISO report of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While we have implemented a cybersecurity program, the techniques used to compromise IT systems continue to evolve. Accordingly, we may not be able to timely detect cybersecurity threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A – Risk Factors."

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: Although as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any material cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target, such as Scage, may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Finnovate Acquisition Corp.


text: Our cybersecurity risk management processes are fully integrated into our overall risk management system and corporate governance framework. This integration ensures that cybersecurity considerations are embedded within our strategic decision-making processes and are aligned with our broader business objectives. By integrating cybersecurity into our overall risk management system, we promote a comprehensive approach to risk mitigation and resilience-building across the organization.

companyName: NewtekOne, Inc.

ticker: NEWT


text: The Company's CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team also elevate any potential cybersecurity issues, whether internal or at a third party with whom we do business, to the CISO.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: disruptions of our business operations; loss of revenue or profits; loss of customers or sales; or other adverse consequences; and We rely on trade secret and proprietary know-how which can be difficult to trace and enforce and, if we are unable to protect the confidentiality of our trade secrets, our business and competitive position would be harmed.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Owlet, Inc.

ticker: OWLT


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives periodic updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as significant incidents.

companyName: KOHLS Corp

ticker: KSS


text: While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe. For further discussion of such risks, see the section entitled "Risk Factors" in Item 1A of this Form 10-K under the heading "Operational Risks."

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: We assess the effectiveness of our policies and controls internally as well as through the engagement of third parties to conduct regular reviews, penetration tests, and vulnerability scans of information systems and applications. Results from these assessments help inform updates to risk assessments, changes to security controls and processes, and updates to policies and standards as appropriate. We employ a variety of measures to detect, prevent, and reduce the frequency and severity of cybersecurity incidents, which may include, but are not limited to, the use of encryption, intrusion prevention, endpoint security, password protection, multi-factor authentication, internal phishing testing and security awareness training, and vulnerability scanning and penetration testing.

companyName: GLOBE LIFE INC.

ticker: GL


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents (of which there were none), that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: AGL Private Credit Income Fund


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: In addition, Registrant's plans require members of its senior management, such as its CEO and CFO, as well as members of management from its, and its subsidiaries', Operations, Information Technology, Human Capital Management, Accounting and Legal teams to participate in Registrant's Cybersecurity Incident Response Team ("CIRT") and to be kept current on all aspects related to a cyberattack, if a cybersecurity incident were to occur.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity procedures designed to address cybersecurity threats and risks. The Director – Information Technology, who has a combination of 15 years of professional experience and education, as well as certifications in cybersecurity, leads the Company's cybersecurity program and is responsible for assessing and managing cybersecurity risk. The Director- Information Technology reviews cybersecurity risks with and reports cybersecurity incidents to the Chief Executive Officer, Chief Operating Officer/Chief Financial Officer, and Senior Director – Financial Reporting.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: As part of Mattel's overall risk management program, Mattel's IT organization has a governance, risk, and compliance group that provides oversight regarding IT-related risks, including cybersecurity risks, and monitors Mattel's IT control environment. This group also works with Mattel's Internal Audit team to assess Mattel's cybersecurity processes. In addition, Mattel's IT organization has a steering committee comprised of internal privacy and cybersecurity experts, chaired by Mattel's Chief Information Security Officer ("CISO"), which is responsible for the development and maintenance of Mattel's privacy and information security programs and regularly reports to Mattel's Chief Technology Officer ("CTO").

companyName: MATTEL INC /DE/

ticker: MAT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Third-Party Service Provider Risk Management We utilize third-party service providers for a variety of reasons, including, without limitation, infrastructure and SaaS cloud computing services, technology and business process service providers, content delivery to customers, back-office support, and other functions. Such providers may have access to information about BBSI or that we hold about our customers, associates or vendors.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: Our commitment to cybersecurity begins at the Board and extends to the senior leadership of all functional areas of the Company. Our Audit Committee oversees our risk management process at the Board level. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management, including in the areas of cybersecurity and other information technology risk and privacy.

companyName: Dayforce, Inc.

ticker: DAY


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives reports from management on our cybersecurity risks, at a minimum annually and as needed. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: In addition, the Company's training and response methodology includes regular end user cybersecurity updates, phishing tests and online trainings. We believe that these measures helps promote a company-wide culture of appropriate cybersecurity risk management, as well as ensure that cybersecurity considerations are an integral part of the Company's ERM decision-making processes at every level. The Company considers industry best practices to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: Our Internal Audit department regularly assesses and reports to the Audit Committee on the effectiveness of our cybersecurity and information technology controls. Our Audit Committee reviews the Company's cybersecurity risk profile and risk management strategies at regular intervals. Our CFO reviews with the Audit Committee categories of risk the Company faces, including cybersecurity risks, as well as the likelihood of the occurrence of cybersecurity risks, the potential impact of those risks and the steps management has taken to monitor, mitigate and control such risks. In addition, our CISO reports at least annually to the Board, and at least quarterly to the Board's Audit Committee, with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of Lazard's cybersecurity program. Updates on cybersecurity risks are reviewed at regular meetings of the Audit Committee and reported to the full Board.

companyName: Lazard, Inc.

ticker: LAZ


text: To maintain incident readiness and resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function. These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities. We believe regular practice and evaluation allows us to minimize the impact of potential disruptions and safeguard our operations, data and reputation.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Cybersecurity is a shared responsibility, and our goal is for all employees to be vigilant in helping to protect our organization and themselves, at all times. We routinely perform simulations and tabletop exercises, and incorporate external resources and advisors as needed, to help strengthen our cybersecurity protection and information security procedures and safeguards. All employees are required to complete annual cybersecurity awareness training and have access to continuous cybersecurity educational opportunities throughout the year. Nasdaq also maintains a cybersecurity and information security risk insurance policy, and our Nasdaq Information Security Management System conforms to ISO 27001 requirements and is ISO 27001 certified.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Our Internal Cybersecurity Team is comprised of the Director of IT Infrastructure and Security, Global Technical Support Manager, and includes Information Security Administrators and Team Members. This team is responsible for managing efforts to assess, detect, prevent, mitigate, and remediate cybersecurity risks, threats, and incidents. In addition, this team meets regularly with the IT leadership team to review current risks and trends, along with monitoring ongoing cybersecurity metrics.

companyName: VOXX International Corp


text: The Company's CIO, CISO, and cybersecurity team collectively have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure. Our CIO and CISO maintain relevant degrees, certifications, and trainings while also being recognized as experts in their respective fields by industry leaders.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: The ISMP is developed by the Company's information security team in collaboration with cross functional stakeholders, and is designed to ensure the organization's security posture and practices are in alignment with contractual, regulatory and industry requirements. Risk assessments against agreed criteria are conducted no less than annually, and sooner if there are significant changes in the environment. Security services are delivered through a combination of internal and third party resources. Formal periodic meetings are held with Company's executive leadership to review relevant components of the ISMP, formal annual reviews of the policies are conducted, formal reviews of the entire ISMP and risk register are conducted at least annually, and more frequently if there are significant changes to the environment. Also, an independent review of the ISMP is conducted in the following ways: (i) an annual HIPAA risk assessment conducted by a third party; and (ii) a HITRUST risk based two year assessment conducted by a third party.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: Engaged two (2) third-party service providers to continuously monitor JAKKS systems for anomalous activity (24 hours a day, 365 days a year); Conduct disaster recovery exercise on a yearly basis;

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: The Company's information security program is managed by the Company's Chief Information Officer (the "CIO"), whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO has extensive global experience in developing and executing information technology strategies. The CIO and the information security team, in collaboration with the Chief Financial Officer and the Audit Committee, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: We subscribe to specialized reports and services that identify emerging cybersecurity threats, thereby keeping our defenses informed and up-to-date. The IT department systematically analyzes such reports of threats and actors, providing us with a deeper understanding of potential risks. We also conduct regular scans of the threat environment, providing real-time insights into the security landscape.

companyName: Cidara Therapeutics, Inc.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business, results of operations or financial condition. However, despite the Company's best efforts, it cannot eliminate all risks from cybersecurity threats or provide assurances that undetected cybersecurity incidents have not occurred. See the "Risk Factors" in Item 1A of this Annual Report on Form 10-K for further information.

companyName: ASHLAND INC.

ticker: ASH