text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Board of Directors receives regular updates on the Company's cybersecurity risk management program from the SVP of IT.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company's compliance function and the Company's internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework, which incorporates the three lines of defense model. In addition, we leverage our global Compliance department, legal teams, cybersecurity teams and privacy teams as key components of our overall cybersecurity program.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO

secItem: Item 1C


text: In the event of a cybersecurity breach, our primary objective is to swiftly contain it by the procedures detailed in our IRP. Once containment is achieved, our focus shifts to remediation and recovery efforts. These actions are tailored to the specifics of the breach and may involve tasks such as rebuilding systems or hosts, replacing compromised files with clean versions, verifying the integrity of affected files or data, enhancing network surveillance or logging to detect future attacks, adjusting administrative account privileges, fortifying network security like firewall configurations, and providing additional training to employees. Additionally, we carry cybersecurity insurance to cover certain expenses associated with security lapses and specified cyber incidents that disrupt our network or those of our vendors, subject to predefined limits and exclusions.

companyName: Extra Space Storage Inc.

ticker: EXR


text: The Company's Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and periodic vulnerability scans, a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage, and we work with leading cybersecurity companies and organizations to leverage third party technology and expertise as appropriate.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our Incident Response Policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer. Our Chief Operating Officer and other senior management work with our incident response team to help mitigate and remediate cybersecurity incidents in which case they are notified. In addition, our Incident Response Policy includes reporting to the Audit Committee for certain cybersecurity incidents. The Incident Response Policy is managed and maintained by our Director of Information Technology, with oversight from our Chief Operating Officer. The Audit Committee receives periodic updates from our Chief Operating Officer regarding the status of our cybersecurity program and our posture to identify and mitigate risks to our information security.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: With respect to our incident response, we have adopted a plan that applies in the event of a cybersecurity threat or incident to provide a framework for responding to such threats and incidents. Our plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. We also employ processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: NPK International Inc.

ticker: NPKI


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or guarantee the effectiveness of our preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2025, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see "Part I, Item 1A. Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management ("ERM").

companyName: Plymouth Industrial REIT, Inc.


text: C. Management's Role and Expertise Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the VP of Security, Compliance, and Risk Management, who has over 15 years of dedicated experience in the field of cybersecurity across multiple industries. Their background includes extensive experience in cybersecurity program development, leadership, and risk management, which is instrumental in the execution of our cybersecurity strategies. Some specific responsibilities include overseeing our governance and compliance, risk management (identification, assessments, and treatment), and security and privacy awareness programs.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.

companyName: Phillips 66

ticker: PSX


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by IHM, the manager of all the Company's properties, with whom we share corporate office space. IHM's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. IHM's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. IHM's cybersecurity risk management processes include technical security controls, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. IHM has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.

companyName: Chatham Lodging Trust

ticker: CLDT


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.

companyName: Veritone, Inc.

ticker: VERI


text: The Audit Committee of the Board of Directors, as overseen by the full Board of Directors, is responsible for oversight of cybersecurity risk.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: The Audit Committee of our Board is responsible for assisting the Board in performing its oversight of our cybersecurity program, its effectiveness and any breaches or other cybersecurity events. Further our Vice President, Information Technology is responsible for apprising the Audit Committee of the Board of cybersecurity incidents consistent with our IRP SOP, promptly for higher priority incidents and in the aggregate for lower priority incidents. Additionally, we maintain a standing agenda item at our quarterly Audit Committee meetings to report any cybersecurity incidents or risk matters.

companyName: OptiNose, Inc.


text: We have developed policies and procedures to provide processes and guidelines for managing cybersecurity incidents with the goal of minimizing disruption, damage, protecting data, and helping recover from a cybersecurity incident as quickly as possible.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our legal, operations, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: The Audit Committee directly oversees our cybersecurity program and receives regular reports from management about the status of our control environment based on the CIS controls, and the prevention, detection, mitigation, and remediation of cybersecurity incidents. This reporting also includes information concerning material security risks and information security vulnerabilities, cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: We maintain a robust privacy compliance program. Employees receive periodic email communications, which train them to detect and report malware, ransomware and other malicious software and social engineering attempts that may compromise our information technology systems. In the first quarter of 2024, we will be implementing a best in class security awareness training system and a quarterly training program for all employees.

companyName: JOINT Corp

ticker: JYNT


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit and Finance Committee. The Audit and Finance Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of Avantor's information technology operations, including cybersecurity risks and information security. The CISO and Chief Information Officer report to the Audit and Finance Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging through regular and requested updates on our strategy and evolving threat landscape.

companyName: Avantor, Inc.

ticker: AVTR


text: The Company adopted an Information Security Policy which governs the Company's management of information technology ("IT") systems, network, information, data and assets. HCSG's Information Security Policy is periodically reviewed based on the National Institute of Standards and Technology Cybersecurity Framework. The Company regularly monitors and measures the performance of the IT Systems and Assets and the Information Security Policy. HCSG has procedures to ensure that any of its vendors and suppliers that create, utilize or process our data take a similar, risk-based approach to information security.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Our information security policies outline the roles and responsibilities within the organization, and our security team works directly with specific members of senior management we call "security ambassadors" to help ensure that the various information security directives are executed as required in their respective departments. Our security partners help to establish, assess, and enhance business processes by ensuring the required information security risk management practices are suitably embedded within their respective processes.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Cybersecurity is an important part of our overall risk management systems and processes and an area of focus for our Board and management. We have developed and implemented an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity and privacy threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, third-party Security Operations Center monitoring and incident response services, proactive patching and risk mitigation, and a third-party penetration testing program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third-party risk management program to ensure we understand the security posture of the partners we integrate with or build business reliance upon, ensure they can meet our cybersecurity standards and policies, and take precautions and mitigations designed to limit our exposure to supply chain attacks; however, there are circumstances in which the efforts of the third parties upon which we rely to maintain risk management programs have not been successful and we cannot ensure in all circumstances that the efforts of the third parties upon which we rely to maintain risk management programs will be successful in the future.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Since we understand that cybersecurity threats are complex and evolving, we have a dedicated team of both internal and external cybersecurity experts, which is led by our Chief Information Officer (CIO), Security Officer. This team is responsible for publishing information technology and security policies, promoting compliance with those policies, implementing a program to mitigate potential threats, and performing periodic risk and maturity assessments. Our risk mitigation measures include network segmentation, cyber protection and containment, detection and response, and recovery. The primary goal of this team is to decrease the risk of cyber incidents having a material impact.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: We have developed and continue to invest in a variety of solutions and controls for real-time threat prevention, detection and instantaneous, automated reaction to such cyberattacks. Our overall strategy in combatting known cybersecurity risks includes:

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Periodically, at least annually, ORIX USA's CIO and/or other members of the ORIX USA information and cybersecurity team will present to BFIM on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).

companyName: BCTC IV ASSIGNOR CORP


text: As a company in general, and particularly, as a government contractor, we understand the critical need to maintain all data and information systems in the safest, most secure manner. Accordingly, our approach to cybersecurity is multi-tiered and comprehensive. Our board of directors ultimately oversees our processes for assessing, identifying and managing material risks from cybersecurity threats. Our management, together with third party contractors, makes these assessments and periodically provides the board with a report and evaluation, including risk mitigation strategies. This report would also include any cybersecurity related incidents which would give rise to a reporting requirement for the company. Although we consider our program for mitigating cybersecurity risks to be part of an overall risk mitigation strategy, we consider it a separate set of processes because of the unique concerns with keeping our and our customers' data secure.

companyName: APPLIED ENERGETICS, INC.

ticker: AERG


text: In this section, we outline our cybersecurity risk management strategies and initiatives aimed at mitigating cyber risks and ensuring the resilience of our organization. From risk assessment and threat detection and continuous improvement, our approach to cybersecurity reflects our resolve to maintain the confidentiality, integrity and availability of our systems and data.

companyName: ESCALADE INC

ticker: ESCA


text: In 2021, we received the externally validated HITRUST certification, the gold standard compliance framework in the health care industry. Through our data security and privacy program and policies, we adhere to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), other federal regulations and best-practices within the health care industry. Moreover, our risk analysis methodology is consistent with ISO 27001, the Federal Information Security Management Act and the U.S. Department of Commerce National Institute of Standards and Technology and Center for Internet Security Special Publication 800-66.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: We are subject to and routinely face cyber-based attacks and attempts by hackers and similar unauthorized users seeking to gain access to or corrupt our information technology systems. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition, or that we believe are reasonably likely to have such an effect over the long term. However, there can be no assurance that we will be able to successfully mitigate the negative impacts of cybersecurity threats in the future. Accordingly, we continue to prioritize our cybersecurity risk management despite the lack of identified material impacts to date.

companyName: FTI CONSULTING, INC

ticker: FCN


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, a review of the vendor's written security program, a review of security assessments and reports, audits, security assessment calls with the vendor's security personnel, and the imposition of security-related contractual obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us, see our risk factors under Part 1, Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Our Chief Information Security Officer (CISO), our information security team, and third-party service providers help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our CISO along with this team, as applicable, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third party enterprise threat reporting services.

companyName: Freshworks Inc.

ticker: FRSH


text: Management is responsible for the day-to-day management of risks we face, while our Board of Directors (Board), as a whole and through its committees, provides guidance on the oversight of risk management.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: The Company's cybersecurity risk management program includes the following, among other things: risk assessments designed to help identify material cybersecurity risks to the Company's critical systems and information;

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Management Oversight Our IT department, in conjunction with the compliance department, assess and manage risks related to cybersecurity. The Sr. Director of Global Information Security, Compliance, Privacy, is the primary management personnel responsible for our cybersecurity program. He has more than twenty years of experience as an information security specialist and holds various cybersecurity professional certifications, including as a Certified Information Security Manager by the Information Systems Audit and Control Association and a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. In addition, the department heads for IT and internal audit have industry recognized credentials and extensive experience in the area of cybersecurity. Specific cybersecurity incidents are tracked by a third-party service provider through a ticketing system.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Under the ERM Program, our Chief Operating Officer prepares for the Board a quarterly update of our enterprise risks, including but not limited to enterprise cybersecurity risks, and conducts with the Board an annual risk identification and mitigation analysis. In addition to updates provided through the ERM Program, the Board is regularly updated by members of management, including the Chief Accounting Officer, Chief Legal Officer, and members of the ERM Steering Committee concerning significant risks facing the Company and processes that have been implemented to mitigate these risks, including but not limited to cybersecurity risks. Additionally, throughout the year, each of our sector presidents who leads one of our major market units provides a comprehensive overview of their market, including risks and challenges. See "Item 1C. Cybersecurity—Governance—Management's Responsibilities" below for additional information regarding our cybersecurity risk management program.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Board of Directors The Company's Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives quarterly reports and presentations from members of the Company's team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Information Officer (CIO), and members of the legal team, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The other members of the Board attend these quarterly reports and presentations to the Audit Committee by members of management. The Company has protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cybersecurity risk and provides updates to the Board regarding such oversight on a periodic basis. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Information Security Officers, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: CIRTRAN CORP

ticker: CIRX


text: In addition, we maintain internal working groups called "corporate risk register groups" dedicated to assessing and managing the various ERM risks facing the Company. There are two corporate risk register groups that relate to cybersecurity risk: Cyber Incident Prevention and Cyber Incident Recovery; the Chief Administrative Officer is the leader of both of these risk register groups. The Chief Administrative Officer likewise serves on the Business Continuity Team as the business continuity technology lead, a role in which she comprehensively evaluates IT system readiness and preparedness should a business continuity event involving cybersecurity or technology interruption occur.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: We are not aware of having experienced a material cybersecurity incident and we take commercially reasonable measures, described above and below, to monitor and respond to threats to keep our systems and data secure. However, we acknowledge that administrative, technical and internal accounting controls as well as other preventative actions may be insufficient to prevent security breaches to our systems or those of third parties with whom we do business due to, among other factors, changing technologies as well as criminal and state-sponsored cybercrime and cyber threats. Further, a material breach of our security or the security of a vendor that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage and could affect the company's strategy, results of operations or financial condition. See Item 1A, Risk Factors, for additional details.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: The Company's Audit Committee is responsible for overseeing the Company's internal controls including oversight over our risk management program and cybersecurity. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization and are standalone from the Company's overall risk management system and processes. The Company seeks to address all material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Canopy Growth Corp

ticker: CGC


text: Our full Board is responsible for oversight of risks from cybersecurity threats, including our cybersecurity risk management program. In carrying out its oversight responsibilities, the Board receives an annual cybersecurity assessment and quarterly scorecards from our Chief Information Officer, which cover topics related to information security, privacy and cyber risks, and our risk management processes, including the status of any recent cybersecurity events meeting specified criteria, the emerging threat landscape, and the status of capital investments in our information security infrastructure.

companyName: TopBuild Corp

ticker: BLD


text: We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC).

companyName: FASTENAL CO

ticker: FAST


text: Information technology risks and controls are regularly assessed as part of our overall self-assessment program, which includes working with a third party organization who regularly tests controls. Observations and outcomes from these self-assessments help drive our internal risk management decision making. Our management and compliance and information technology professionals, including our Chief Information Officer ("CIO"), are responsible for the maintenance and enforcement of our cybersecurity and information security policies and procedures. In addition members of the cybersecurity and information security teams maintain CISSP industry certifications. In addition, we have organizational charts in place to communicate key areas of authority, responsibility, and lines of reporting to personnel related to the design, implementation, operation, maintenance, and monitoring of our cybersecurity environment.

companyName: Perella Weinberg Partners

ticker: PWP


text: The Audit and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit and Compliance Committee. Internal Audit maintains a dedicated cybersecurity auditing team that independently tests our cybersecurity controls.

companyName: Alphabet Inc.

ticker: GOOGL


text: The Vice President of IT acts as our head of information security in leading our information security organization. Our Vice President of IT has over 25 years of industry experience leading large technology organizations, including, most recently, as the leader of the IT organization at a large privately held company. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at other technology companies.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Our Head of IT Risk, with the CTO's oversight, is primarily responsible for assessing, monitoring and managing material risks from cybersecurity threats and manages our IT Risk Management team. The Head of IT Risk is currently a Certified Information Systems Security Professional (CISSP), with a Master of Science in Digital Forensic Science and has 18 years of cybersecurity work experience. The members of our IT Risk Management team have an average of five years of cybersecurity work experience with degrees in information technology and computer engineering. The Head of IT Risk works closely with the CTO, including holding bi-weekly meetings, to discuss cybersecurity risks and any changes in our cybersecurity policies and practices. The CTO, Head of IT Risk and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.

companyName: Enova International, Inc.

ticker: ENVA


text: Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Board of Directors is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures.

companyName: ExcelFin Acquisition Corp.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain a cybersecurity incident response program, which includes a set of protocols and procedures that we would follow in the event of a cybersecurity incident. Pursuant to the program and its escalation protocols, designated personnel are responsible for handling and managing potential cybersecurity incidents. We have relationships with a number of third-party service providers to assist with cybersecurity incident containment and remediation efforts.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: Regional heads of cybersecurity and chief technology officers oversee their respective cybersecurity programs, including regional Cybersecurity Steering Committees (each, a "CSSC"), which are comprised of senior executives and extended leadership, and which provide oversight of cybersecurity investments by monitoring, evaluating, approving and supporting actions related to cybersecurity risk, incident management, investment and prioritization of projects and services.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: The CISO remains informed about developments in cybersecurity, including potential threats and emerging risk management techniques, reporting such information to the Chief Information Officer and Technology Committee periodically. The CISO implements and oversees processes for the regular monitoring of information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact of any incident, and long-term strategies for remediation and prevention of future incidents.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Our Information Security Management System ("ISMS") is a key element of our information security program, and it is designed to identify, assess, help mitigate, and monitor information technology risks across the organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party risk management, audit management, incident response and security awareness, including employee security awareness trainings and other initiatives. Our ISMS also includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks identified and managed thereby, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS specifically and our information security program generally.

companyName: Alkermes plc.

ticker: ALKS


text: Below is an overview of our processes for assessing, identifying, and managing material risks from cybersecurity threats, all of which are conducted in-house.

companyName: Health In Tech, Inc.

ticker: HIT


text: Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure understanding of their cybersecurity posture, and their responsibility in protecting our asset appropriately.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Our Information Risk Management ("IRM") department provides second line defense oversight of the Information Security Program in support of senior management and the Board of Directors' responsibility to provide appropriate risk oversight. Owned by the VP, Information Security and Technology Risk ("VP-ISTR") in IRM, the Information Security Policy provides a framework for the security of information assets and computer resources and is consistent with our five principles that guide the Company's approach to risk management: Comprehensiveness, Accountability, Independence, Defined Risk Appetite and Transparency. The Information Security Policy is designed to comply with applicable laws and regulations, such as the GLBA and the Sarbanes-Oxley Act.

companyName: Discover Financial Services


text: when appropriate, use of external subject matter specialists, including assessors, consultants, auditors or other third parties, to provide incident response services and to conduct independent assessments of internal response readiness. engagement in security practices that include physical, administrative and technical safeguards of systems and hardware.

companyName: AerSale Corp

ticker: ASLE


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, and information security considerations arising with respect to our peers and third parties. The audit committee discusses such matters with our Chief Information Officer.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Aligning with various government and industry standards such as: National Institute of Standards and Technology ("NIST") Cybersecurity Framework, HIPAA, 21 CFR Part 11 and Sarbanes-Oxley ("SOX"), Conducting ongoing Security Awareness Training to keep employees informed of threats and how to spot them, Evaluating the cybersecurity policies of third-party vendors and service providers, Implementing redundant systems for mission critical operations, Developing and implementing Business Continuity/Disaster Recovery plans and procedures, and Ensuring robust protective measures such as: Email security including phishing protection Endpoint Security Perimeter Firewalls Physical Access controls Rapid Ransomware monitoring and recovery Multi-Factor Authentication Non-administrative computer access for typical users

companyName: Vivani Medical, Inc.

ticker: VANI


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors monitors and assesses strategic risk exposure, and our executive officers manage the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole and through the audit committee.

companyName: Revolve Group, Inc.

ticker: RVLV


text: We utilize a variety of administrative, technical and physical safeguards that take into account the nature of our IT environment, information assets and cybersecurity risks posed by both internal and external threats. We have incorporated cybersecurity coverage in our insurance policies, and our goal is to keep our data and systems, as well as our employees, safe from cybersecurity threats.

companyName: Kimco Realty OP, LLC


text: We have not experienced a cybersecurity incident that had a material impact on our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.

companyName: SS Innovations International, Inc.

ticker: SSII


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity, risk and compliance team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: We have implemented procedures for assessing, identifying, and managing significant risks from cybersecurity threats and have incorporated these procedures into our overall risk management systems and processes. Our Board of Directors regularly evaluates significant risks from cybersecurity attacks, including any potential unauthorized occurrence on or conducted through our information systems that may adversely affect the confidentiality, integrity, or availability of our information systems or any information stored there. The program to manage cybersecurity risks has tools and activities designed to identify, examine, and manage current and potential cybersecurity threats, as well as plans and strategies to deal with threats and incidents.

companyName: Global Clean Energy Holdings, Inc.


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: Nature's Miracle Holding Inc.

ticker: NMHI


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, our Director of Information Security, and our Director of Infrastructure. These individuals collectively have over 88 years of prior work experience in various roles in the information security field, including managing and implementing effective information technology and cybersecurity programs, as well as relevant degrees and certifications, including a Certified Information Systems Security Professional certification. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Information Officer reports to the entire Board about cybersecurity threat risks, among other cybersecurity matters, at least twice annually or more frequently as circumstances may require.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: We take cybersecurity threats seriously. We have developed and implemented processes to assess, identify and manage material risks from cybersecurity threats. These cybersecurity processes are a part of our overall enterprise risk management system, sharing governance processes and reporting structures with other components of our enterprise-wide risk management system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, we will activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we may engage third-party cybersecurity consultants to assist with our cyber incident procedure. Risks from cybersecurity threats have the potential to materially affect us, including our results of operations and financial condition.

companyName: JOHNSON OUTDOORS INC

ticker: JOUT


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal risks. This includes cybersecurity, a critical component of our broader enterprise risk management program given the increasing reliance on technology by customers, vendors, agents, and our own employees and the ever-evolving risk of cyber threats. Our Chief Information Security Officer leads the Information Security team that administers the Company's information security program, which covers cybersecurity risk. The Chief Information Security Officer reports to the Chief Digital & Innovation Officer, and works alongside the Chief Risk Officer who provides an effective second line of defense on technological and security risk management. Our cybersecurity program aims to address risks through a cross-functional approach that focuses on confidentiality, security, and availability of information vital to protecting our customers, employees, stakeholders, and the Company as a whole.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the company or our business strategy, results of operations or financial condition.

companyName: Verve Therapeutics, Inc.


text: For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A. Risk Factors in this Annual Report, including the risk factor captioned "We are subject to stringent and changing privacy, data protection, and information security laws, contractual obligations, self-regulatory schemes, government regulation and standards related to data privacy and security. The actual or perceived failure by us, our CROs or vendors to comply with such obligations could result in harm to our reputation, regulatory investigations or actions, significant fines and liability, disruption of our clinical trials or other material adverse effects to our business."

companyName: Immunovant, Inc.

ticker: IMVT


text: The Risk Committee, which is made up of our Chief Financial Officer, Group General Counsel, Chief Operating Officer and the Divisional Presidents of CRH Americas and CRH International, is the executive oversight body for risk management, including cybersecurity risks and the work of the CISO, GIS and related teams. The Risk Committee meets quarterly with the Head of ERM to assess risks facing CRH, and, on an as-needed basis, meets with other members of CRH management regarding cybersecurity risks and developments. The Risk Committee also reviews the half-yearly risk updates that are provided to the Audit Committee prior to dissemination.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: We also have implemented an incident response plan that is designed to facilitate our response to cybersecurity incidents and escalation of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us, to our executive officers, other members of our senior management team and other internal stakeholders. This plan is designed to provide our executive officers and other members of our senior management team with the information needed to assess the materiality of a cybersecurity incident and the need for public disclosure.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: In addition, our IT infrastructure management program maintains an IT Crisis Response Plan ("ICRP") where we have disaster recovery plans for key applications. The ICRP includes processes which address disruption of services that affect any IT services supplied by third-party vendors or service providers. Our IT infrastructure management program also ensures an initial risk assessment is conducted on all new third-party vendors prior to engagement.

companyName: MOOG INC.

ticker: MOG-A


text: As part of the Company's enterprise risk management, the Board of the Company receives, reviews and assesses reports from the Board's committees and from management relating to enterprise-level risks. The Audit Committee reports its cybersecurity risk assessments to the full Board at each regularly scheduled Board meeting.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: In 2023 and 2024, cybersecurity incidents have occurred involving our vendors and other contractual counterparties that did not materially and adversely impact our operations. We cannot assure that future incidents will not materially and adversely impact us. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this annual report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in a material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our ability to provide services to our customers, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits and otherwise adversely affect our operations."

companyName: ONITY GROUP INC.

ticker: ONIT


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please see section "Risk Factors --Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business," in this Annual Report on Form 10-K.

companyName: Merus N.V.


text: Due to our size and the size of our employee base, we use third-party vendors to assist us with our network and information technology requirements. Since 2019, BDO USA, LLC ("BDO") has acted as our outsourced chief technology officer/chief information security officer ("CTO/CISO") and provided us with the following services through a dedicated partner in BDO Digital's Security & Compliance: • Overseeing chief security role and informing leadership of cybersecurity risks and the role of staff in protecting information, including, but not limited to: Monitoring emerging risks, suggesting and overseeing implementation of mitigations; Championing security awareness and training programs; and Reporting significant security events to leadership.

companyName: LXP Industrial Trust

ticker: LXP


text: A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;

companyName: Maitong Sunshine Cultural Development Co., Ltd

ticker: MGSD


text: f. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically.

companyName: Axogen, Inc.

ticker: AXGN


text: Incidence Response and Business Continuity: We have comprehensive Incidence Response and Business Continuity plans in place designed to ensure the continuity, availability and accessibility of our systems and data, even in the face of unforeseen events such as natural disasters or cyber incidents, which plans and systems we test regularly.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: CDRM manages our cybersecurity program, including by fostering collaboration with partners across business units and global functions to identify and assess material cybersecurity threats, evaluate their severity, and establish actions to mitigate and manage such risks. Business units and global functions are responsible for addressing risks and implementing our policies and standards within the respective business unit or function. Compliance with our policies and standards is assessed by our internal audit organization, through periodic cybersecurity audits. The results of these audits, together with our learnings from internal and external threats, drive periodic reassessment of and structured updates to our cybersecurity framework, as deemed necessary or appropriate. As part of our cybersecurity program, we also evaluate data collected from our attack surface management tools using a framework that quantifies the likelihood and severity of risks to produce a prioritized set of vulnerabilities for remediation. We also require mandatory cybersecurity training for employees and periodically conduct Company-wide phishing simulations.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Tenable recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, critical data (including without limitation intellectual property, confidential information that is proprietary, strategic or competitive, customer vulnerability data, and information systems data), and exposure management solutions.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. Our cybersecurity and risk management program is developed based on: • Continuous Development: Ongoing refinement of our risk management processes. • Partners and Tools: Leveraging global access control and activity monitoring solutions. • Education and Training: Implementing company-wide policies and proactive user training. • Continuous Monitoring: Regular surveillance of our environment. • Access Management: Ensuring only authorized users have access to our network.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: The Board of Directors, Audit Committee and the Information Technology (IT) Steering Committee, which is comprised of members from various departments including IT, Accounting, Compliance, Lending, Credit, Human Resources, Operations, Treasury Management, Treasury Support, Retail, Mortgage Sales, Mortgage Operations, Commercial Operations, and the Executive Team, provide oversight and direction of cybersecurity threats and risk management. The Board of Directors reviews and approves the Company's policies related to Information Security and receives periodic updates from the IT Steering Committee and management in the areas of cybersecurity risks, controls, projects and initiatives, vulnerability assessments, vendor management, and security considerations. The Board of Directors is promptly notified and provided information on any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates of any such incidents until they are resolved.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: Risk Management and Strategy Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry. To mitigate the adverse impact of these threats to our business, we take a comprehensive approach to cybersecurity risk management and make proactively securing our systems and the data customers, employees, partners, and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. See "Risk Factors — Risks Related to Our Intellectual Property and IT Systems" for a more comprehensive description of cybersecurity-related risks. We have devoted significant financial and personnel resources to implement and maintain security measures, which are designed to mitigate these risks and meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. While in the last fiscal year, we did not identify a cybersecurity threat or incident that resulted in a material adverse impact to our business, results of operations, or financial condition, there can be no guarantee that we will not experience or have not experienced such an incident.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our critical business systems are fully redundant and backed up at separate locations. Separate business and SCADA networks allow for isolation of potential threats and enhance the security of these systems. We maintain a dedicated SCADA department, staffed around the clock, to evaluate and respond to significant events and incidents that may impact our pipeline operations. Anti-virus solutions are deployed on our SCADA systems and workstations in our data centers and control centers.

companyName: TransMontaigne Partners LLC


text: Cybersecurity Risk Management and Strategy DigitalBridge's risk management program is headed by its Chief Information Officer, the Vice President of Cybersecurity and the Company's Cybersecurity Architect. They possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and they leverage their extensive cybersecurity experience to effectively manage risk. The Company's information technology ("IT") team is led by the Company's Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company's IT team meets on a recurring basis, and at least quarterly, with the senior members of DigitalBridge Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization. In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company's information technology environment, provide recommendations to strengthen the program, and update us on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related to DigitalBridge portfolio companies.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Tal Hornstein, our Chief Information Officer and Chief Information Security Officer ("CISO"), leads our cybersecurity program and oversees teams supporting security functions across the company. Mr. Hornstein holds a CISSP certification from ISC2 and has over 20 years of experience in multiple cybersecurity and technology-related roles. He joined Hippo in late 2021 and has been instrumental in designing and executing our entire cybersecurity stack.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Markel Ventures requires real-time reporting of material cybersecurity incidents to understand how the matters are being managed, assess whether public disclosure is required and inform Markel Group senior management of relevant matters. Depending on the cybersecurity incident, third parties may be engaged by the Markel Ventures businesses to assist them in understanding and managing the event.

companyName: MARKEL GROUP INC.

ticker: MKL


text: Our management team, including our Vice President of Cybersecurity and Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and IT has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and IT was the Leader of Global Information Security for New Balance.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Processes for the Identification of Cybersecurity Threats Our Information Security team is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with other groups in the Company to understand the severity and the likelihood of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. The Information Security team has processes designed to keep the Company apprised of the different threats in the cybersecurity landscape – this includes intelligence networks alerts, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items, and attending security conferences. The team also regularly monitors our internal network and our customer-facing network to identify security risks. In addition, the team has completed several assessments and threat modeling tabletop exercises, based on "what-if" scenarios.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: We maintain a Risk Register documenting identified risks, including those from cybersecurity threats, their potential impact, and mitigation strategies. Through our internal audit function, we also perform an annual risk analysis using a risk matrix to prioritize risks based on their potential impact and likelihood.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: As our Information Security team monitors the security and effectiveness of our policies and processes, they also work to keep the CISO, CRO and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Depending on the nature and severity of an incident, this reporting structure provides for escalating notification to our CEO and the board of directors.

companyName: OneStream, Inc.

ticker: OS


text: Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity / information security program. The Information Security Officer reports directly to the Chief Operations Officer, and periodically reports to the Audit and Examination Committee of our board of directors.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Although risks from cybersecurity threats have to date no t materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Information Technology, Cybersecurity and Data Protection— Failure to maintain the security of our information and technology networks, including personal information and other client information, intellectual property and proprietary business information could materially adversely affect us." Board of Directors has oversight of the Company's cybersecurity program.

companyName: Mag Mile Capital, Inc.

ticker: MMCP


text: Our approach to cybersecurity risk management includes the following: • Multi-Layered Defense and Monitoring – We work to protect our computing environments from cybersecurity threats through multi-layered defenses and monitoring efforts to identify cybersecurity threats, and to help prevent future attacks. We utilize data analytics systems to detect anomalies and identify cyber threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use third-parties to conduct additional reviews and assessments. • Insider Threats – We maintain organizational controls such as limited access, and access removal for terminated employees, designed to minimize insider threats, and address potential risks from within our Company. Our measures and controls are informed by industry practices, and designed to be consistent with applicable law, including privacy and other considerations. • Third Party Risk Assessments – We conduct privacy and information security risk assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access are required to participate annually in training, including phishing simulations and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – Our standard terms and conditions contain contractual provisions requiring that our third-party suppliers disclose to us the technical and organizational measures they maintain, the standards and certifications by which they are evaluated for information and cyber security, and their cybersecurity insurance protection level. We seek to mitigate risk by evaluating the foregoing against any potential cyber-related risks depending on the nature of the services being provided.

companyName: Zevia PBC

ticker: ZVIA


text: Internal and External Risk Evaluations An annual Information Technology Audit, which is facilitated by the Internal Audit Department, is conducted via a co-sourcing agreement with a third-party auditor. The objective of the IT audit is to evaluate the effectiveness and efficiency of operations, test the reliability of data and IT controls, and ensure compliance with applicable laws, regulations, guidance, and industry best practices. The audit scope addresses IT Governance, IT Management, IT Operations, and IT Security. Testing of the internal network environment and external network perimeter are included in the Results of the IT Audit and are reviewed with the IS Steering Committee and Company management. For any exceptions identified, a responsible party is assigned, and action plans are developed to address corrective measures. The final results of the IT Audit are reviewed with the Board Audit Committee. The status of unresolved audit issues along with their priority ratings is reported to both Management's IS Steering Committee and the Board Audit Committee at each meeting.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: P. 24 – THE NEW YORK TIMES COMPANY systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: NEW YORK TIMES CO

ticker: NYT


text: In the event of a cybersecurity incident, the Company has established an incident response plan to address the matter promptly and effectively. Our CISO leads our Cybersecurity Incident Response Team ("CIRT") that is responsible for leading and coordinating CACI's response to cybersecurity incidents in accordance with CACI's established cybersecurity incident response plan and response processes. In accordance with these policies, cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for escalation to CACI's Executive Incident Assessment Committee. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a breach, we have a comprehensive plan in place for assessing and addressing any potential threats to our information security. We maintain a Cyber and Data Incident Response Plan and Framework, which identifies and describes the roles and responsibilities of the Cyber Incident and Response Team and the Cyber Incident Oversight Committee. The Cyber Incident Response Team is responsible for receiving information relating to possible incidents, investigating and analyzing them, and taking action to avoid and mitigate the damage caused by such incidents. The Crisis Oversight Committee, chaired by our CBO, is responsible for support and oversight of the Cyber and Data Incident Response Plan and Framework and oversight of the Cyber Incident Response Team's execution of the plan in the event of a cyber incident.

companyName: Enstar Group LTD


text: Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. The team manages governance, risk and compliance, security operations, and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing, processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: VP of Information Security and cybersecurity stakeholders regularly brief the senior leadership team on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Our board of directors has delegated oversight of the Company's cybersecurity risks to the audit committee. The audit committee reviews the Company's information technology and data protection strategies, oversees and assesses risk with respect to cyberattacks and data privacy matters and receives bi-annual updates from our CTO. The audit committee then provides updates and recommendations to the full board on cybersecurity matters.

companyName: Hamilton Lane INC

ticker: HLNE


text: We also maintain a formal Generative Artificial Intelligence ("GAI") Policy and Program that provides oversight of cybersecurity, privacy, and contractual risks related to enterprise use of GAI. All GAI tools and use cases must be submitted for review and approval by a subcommittee of CCDC members based on specific cybersecurity, privacy, and contractual requirements.

companyName: Gold.com, Inc.

ticker: GOLD


text: We leverage industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center for Internet Security ("CIS") to inform how we identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SKECHERS USA INC


text: As of the date of this Annual Report on Form 10-K, the Company has not experienced any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company. However, we face ongoing risks of cybersecurity threats that, if realized, could result in the loss of sensitive business or customer information, disruption to our systems and operations, expose us to litigation and reputational risk and adversely affect our guests, employees or business partners. For additional information on the risks we face from cybersecurity threats, see Item 1A. Risk Factors – "Cyber-attacks could have a disruptive effect on our business."

companyName: Six Flags Entertainment Corp/OLD


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: We recognize that cyber incidents, including but not limited to data breaches, ransomware attacks, and system outages, pose a material risk to our operations. We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes are embodied in our Information Risk Management Policy, which is supported by a set of standards and procedures, to provide a structured methodology for identifying, assessing, and managing risks to critical assets, including applications and systems. The Information Risk Management Policy is designed to provide a consistent risk management approach across the organization to safeguard against existing and emerging threats and to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The processes for cybersecurity risk management that we follow are integrated into our enterprise risk management ("ERM") program.

companyName: StoneX Group Inc.

ticker: SNEX


text: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board's Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a detailed and comprehensive framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company's senior management, including our ECCRT (as defined below), and the Board. Under the guidance of our CISO, the Response Plan is routinely evaluated and updated as appropriate. In addition to our Response Plan, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents. For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction. Accordingly, we require employees to complete periodic access-based and role-based privacy and cybersecurity training. These trainings are routinely updated to reflect changes in the threat environment, assessment, and/or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.

companyName: Cencora, Inc.

ticker: COR


text: Cybersecurity is among the risks identified for Board-level oversight, with the Audit Committee of our Board of Directors responsible for overseeing our policies, practices, and assessments with respect to cybersecurity. Our Audit Committee and Board of Directors receive regular updates throughout the year on cybersecurity from our Finance, Risk and Sustainability (the "FRS") Committee, which is tasked with risk management, data protection, and monitoring compliance with our cybersecurity policy and also responsible for assessing and managing material risks from cybersecurity threats. The FRS Committee is comprised of our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Senior Vice President of IT, and VP of Corporate Development. Our cybersecurity risk management and strategy processes are led by our Senior Vice President of IT and our Chief Legal Officer, who collectively have extensive prior work experience and expertise over multiple decades developing and managing information security and cybersecurity strategy and programs and managing operational risk and incident response strategies.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers and penetration testing firms.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Our cybersecurity incident response plan includes an escalation process to senior management, who evaluates various factors related to the cybersecurity incident to assess the impact on the Company and any required disclosures. If a cybersecurity incident was determined to be material by senior management, our Board of Directors would be promptly notified and the incident reported based on applicable legal requirements. Our processes also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or systems. We evaluate third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. We conduct continuous vulnerability assessments and continuous penetration testing. Additionally, we undergo internal and external assessments of our processes to identify opportunities for improvement and reduce exposure to cybersecurity incidents.

companyName: NOV Inc.

ticker: NOV


text: Board of Directors' Oversight of Risks from Cybersecurity Management, under supervision of the CEO and CFO, has developed a system of internal controls that identifies risks to the Company, designed controls intended to reduce risks to an appropriately low level, implemented control procedures, and subsequently tested such control procedures. Management presents an enterprise risk management assessment to the Audit Committee on a quarterly basis and provides the Audit Committee with frequent updates of specific financial statement risks. Risks associated with cybersecurity are included in these risk assessments, subjected to testing of key controls, and reflected in management's reports to the Audit Committee. The Board of Directors receives periodic briefings on selected risk matters, and is invited to participate in each Audit Committee meeting and, as such, is provided with the same information presented to the Audit Committee.

companyName: VISTA GOLD CORP

ticker: VGZ


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: 4. Incident Response Plan: PyraMax Bank maintains an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan if tested, reviewed, and approved by the IT Steering Committee annually and reported to the board of directors.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The Partnership's management also has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. These processes include, but are not limited to: • Maintaining an inventory of all third-party vendors engaged by the Partnership and assessing each vendor's level of access to the Partnership's IT and OT systems and information; and • Implementing access controls that restrict vendor access to only specific Partnership systems and information necessary to perform their service.

companyName: Summit Midstream Partners, LP


text: Our Chief Security & Risk Officer reports to the Chief Technology Officer and works closely with the Chief Legal Officer to ensure that all disclosure or reporting requirements are satisfied if an incident were to occur. The Chief Security & Risk Officer leads Parsons' overall cybersecurity function and provides quarterly reports to the Audit and Risk Committee on our cybersecurity risks, including briefings on our cybersecurity risk management program and cybersecurity incidents. The Audit and Risk Committee also receives periodic presentations on relevant cybersecurity topics as part of the Committee and the Board's continuing education on topics that impact public companies.

companyName: PARSONS CORP

ticker: PSN


text: We have an information security policy, which is supported by a security awareness program. We also have an information security training and compliance program in place. Our information technology (IT) department has engaged a third party to provide regular cybersecurity awareness training to our employees. We also have business continuity plans and incident response plans in place to prepare us to act quickly in the event of cyber incidents. We test our business continuity plans and incident response procedures at least annually.

companyName: B&G Foods, Inc.

ticker: BGS


text: The CIO is the management position with primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. The CIO has deep experience in information systems and technology, including developing information and cybersecurity programs, roll-outs of new technology, information security audit and assessments, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CIO has experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CIO joined the Company in 2020, bringing over 15 years of experience leading IT strategy and change initiatives in the consumer packaged goods industry, and reports directly to our CEO.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our cybersecurity policies are focused on ensuring the security and protection of our systems, networks, and proprietary data which includes trade secrets, intellectual property, corporate strategic plans, marketing plans, material non-public financial information, and personally identifiable information such as employee and customer information. We also actively engage with key vendors as part of our continuing efforts to actively monitor system access, identify and quarantine potential cybersecurity threats, to assess and implement cybersecurity systems and tools, and to enhance the effectiveness of our information security policies and procedures.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Our board of directors has the ultimate oversight of the Company's risks—including cybersecurity risks—with our Audit Committee assisting the board in their oversight of cyber and information security risks. Members of management that possess information security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity program from management on a quarterly basis and more frequently as determined to be necessary or advisable. Updates to the Audit Committee include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the board at least annually. Finally, in the event a material cybersecurity incident were to occur, the CAO and Vice President of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident and making the determination of materiality and any related disclosure.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during vendor onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.

companyName: PLUMAS BANCORP

ticker: PLBC


text: Our employees play a vital role in protecting our and our clients' data. We provide regular, mandatory training for our employees regarding cybersecurity threats to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also maintain a third-party risk management program to identify, assess, mitigate and monitor risks associated with third parties' software and services that we utilize.

companyName: FISERV INC

ticker: FISV


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our CIO reports on cybersecurity strategy, status of cybersecurity risk control efforts, and third-party cybersecurity risk assessments of our information technology security processes and implemented technologies to the General Counsel, Chief Accounting Officer, Chief Financial Officer, Chief Executive Officer, and our Audit Committee. Our full Board has access to these Audit Committee presentations, including any provided materials. In the event of any material cybersecurity incidents, these presentations would also include information regarding those incidents, including status of mitigation and remediation.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: Our management and the Board recognize the critical importance of maintaining the trust and confidence of our business partners, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board and executive officers are responsible for monitoring and assessing strategic risk exposure, and for the day-to-day management of the material risks that we face. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: DYNAMIC AEROSPACE SYSTEMS Corp

ticker: BRQL


text: Other key members of management assist our CISO in the oversight of cybersecurity risk management through their membership in the ISSC, which is chaired by our CISO and is comprised of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, President of Direct-to-Consumer, and Global Digital, Privacy Counsel, and our Vice President of Internal Audit. The ISSC reviews and discusses comprehensive quarterly and annual reports from our CISO and the IT security team in order to provide cooperation, collaboration, and consensus driven information security guidance to the IT department and the Company as whole.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO