text: The Chief Information Security Officer ("CISO") regularly updates the Audit Committee and Allstate Board on Information Security Program status, cybersecurity risk management, the control environment, emerging threat intelligence and key risk and performance measurements.

companyName: ALLSTATE CORP

ticker: ALL


text: We incorporate third-party expertise in various aspects of our cybersecurity program. One or more third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.

companyName: LA-Z-BOY INC

ticker: LZB

secItem: Item 1C


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we do not believe are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cybersecurity attack disrupts the Company's critical operations, service or financial systems. See "Item 1A — Risk Factors — Risks Related to our Business and Operations — Information Technology, Cybersecurity and Intellectual Property" for additional information on risks related to cybersecurity threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Our cybersecurity risk management program includes the following: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; and cybersecurity awareness training of our employees, incident response personnel, and senior management There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Cybersecurity Governance Our Board considers cybersecurity risks as part of its risk oversight.

companyName: NEXGEL, INC.

ticker: NXGL


text: Additionally, as part of the Adviser's vendor management program, members of the Adviser's information security teams will conduct periodic due diligence on the cybersecurity/data security programs of the Company's third-party service providers (this review is conducted annually with respect to the Company's custodian, sub-administrator and transfer agent). As part of their oversight of third-party service providers to the Company, the Company's CCO and the Adviser's CISO review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters and evaluate the service providers' use of information systems which may give rise to information technology vulnerabilities. Potential cybersecurity risks are identified and implications of such risks, if any, to the Company are assessed and monitored. In addition, the CCO receives regular reports from the third-party service providers regarding any cybersecurity threats and incidents at such service provider.

companyName: First Eagle Private Credit Fund


text: Identification and Reporting We implemented a cross-functional approach to assessing, identifying, and managing material cybersecurity threats and incidents. We have put in place controls and procedures to identify, classify, and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. Incidents are reported and tracked through our third-party IT firm's online support system.

companyName: Eiger BioPharmaceuticals, Inc.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Trustees.

companyName: VORNADO REALTY LP


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security practices and ensure maintenance of backup and protective systems. We review System and Organization Controls 1 (SOC 1 Type II)

companyName: Anixa Biosciences Inc

ticker: ANIX


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are fully integrated into our enterprise risk management (ERM) program and include the following areas of focus: • Systems Safeguards: Preventing and mitigating cybersecurity threats, including through the use of firewalls, intrusion prevention and detection systems, anti-malware software, access controls and other system safeguards. • Incident Response: Identifying and responding to cybersecurity incidents in accordance with our information security incident response plan. • Collaboration: Collaborating internally and with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: Maintaining a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems. • Training: Reinforcing our information security policies, processes and practices through periodic mandatory training for Company personnel. • Governance: Designing a comprehensive framework for the oversight of cybersecurity risk, with regular interaction between the Board Operational Risk Committee and the Company's ERM function, our Chief Information Security Officer (CISO) and members of Company management and relevant management committees, including the Company's Management Operational Risk Committee (the Management Operational Risk Committee).

companyName: LendingClub Corp

ticker: LC


text: As discussed in further detail in Item 1A – Risk Factors, the Company faces an increasingly challenging cybersecurity environment, and from time to time the persistent efforts of bad actors to gain unauthorized access to our and our service providers' information systems and our confidential and proprietary information are successful. In fiscal 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents or will not discover additional information about previously detected events.

companyName: Walt Disney Co

ticker: DIS


text: The Company's CTO is responsible for overseeing the Company's overall technology strategy, including integrating security considerations into all aspects of our technology development. Our CTO has over 20 years of experience in technology management roles.

companyName: First American Financial Corp

ticker: FAF


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our Technology infrastructure or our third-party providers' Technology infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our Technology infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Operating Officer has experience supervising and managing company security and privacy departments.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Our cybersecurity program is overseen by a Vice President of IT & Digitization and information technology team (collectively, the "IT Team") responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The IT team includes members with experience developing and implementing enterprise-wide cybersecurity strategies and initiatives, managing risks relating thereto, and evaluating industry standards and regulations.

companyName: CTS CORP

ticker: CTS


text: Key Components of the Cybersecurity Program: • Ongoing Detecting and Monitoring - Continuous surveillance of networks to identify threats and intrusions in real-time. • Vulnerability Assessment - Regular assessments conducted by both internal teams and external partners to identify system vulnerabilities. • Employee Training - Regular cybersecurity training and awareness campaigns are undertaken to equip employees with the knowledge needed to mitigate risks. • IT Leadership - The IT Department leads the implementation of the cybersecurity risk management program, ensuring adherence to Company and regulatory standards.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Our Audit Committee of our Board of Directors assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports on its review with the Board of Directors. is responsible for day-to-day assessment and management of cybersecurity risks and reports regularly to our Audit Committee.

companyName: IDT CORP

ticker: IDT


text: Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes, which provides the basis for how cybersecurity risks are factored into the Company's risk management initiatives. Along with the rest of the Company, the cybersecurity team, led by the CISO, sets goals for cybersecurity risk management that are then periodically tracked and reported back to the cybersecurity team and to our CEO and Audit Committee.

companyName: TRIMBLE INC.

ticker: TRMB


text: The Company recognizes that cybersecurity is fundamental to maintaining trust with shareholders, customers, and other stakeholders. By prioritizing cybersecurity as a strategic imperative, the Company strives to safeguard business operations, sensitive information, and integrity which preserves the value delivered to all our constituents.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: The Company has processes in place for assessing, identifying, preventing, and managing material risks from cybersecurity threats, including related to the use of third-party service providers. In addition, the Company leverages the security and monitoring tools of third-party service providers.

companyName: CorMedix Inc.

ticker: CRMD


text: Our Chief Executive Officer and Vice President of Technology provide periodic briefings to the Board of Directors regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, and from our Legal and Compliance, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment. We continue to invest in talent and infrastructure in our IT department to manage IT operations and mitigate cyber risk.

companyName: Y-mAbs Therapeutics, Inc.


text: Third-Party Risk Management: CTO and the MSP maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of CTO's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Our information technology systems are managed by our CIO. He has over 45 years of experience in digital systems and technology in the animal health, bio-tech pharmaceutical, pharmaceutical and oil and gas industries. He has held multiple leadership roles driving business value for investments in digital solutions. He also spent six years as a leader within internal auditing, providing experience and wisdom in business-driven risk management.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Our Senior Vice President, Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Governance and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.

companyName: OOMA INC

ticker: OOMA


text: Our sole director, who also serves as our President and Chief Executive Officer, regularly receives updates from other members of management regarding our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In these sessions, our sole director generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Financial Officer. Our sole director also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: NETLIST INC

ticker: NLST


text: We design and assess our program based on ISO 27002 standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27002 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: These efforts, coupled with the isolation of industrial networks and structured software installation processes, demonstrate our continued commitment to maintaining robust cybersecurity defenses.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: We face several cybersecurity risks in connection with just conducting business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and CEO, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: SEC's purpose in adopting new disclosure items in Item 106(b)(1) was to "allow investors to ascertain a registrant's cybersecurity practices, such as whether they have a risk assessment program in place, with sufficient detail for investors to understand the registrant's cybersecurity risk profile," while at the same time avoiding details that "could increase a company's vulnerability to cyberattack." 15 Cybersecurity Threat Disclosure. Under new Item 106(b)(2), companies must:

companyName: Energy & Water Development Corp

ticker: EAWD


text: BREIT's board of directors is responsible for understanding the primary risks to our business. The audit committee of BREIT's board of directors is responsible for reviewing BREIT's and the Adviser's IT security controls with management and evaluating the adequacy of BREIT's and the Adviser's IT security program, compliance and controls with management.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Our ECS team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. Formerly known as our Information Security and Risk ("ISR") team, the ECS team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ECS team also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk registrar and oversees the security awareness program.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: Information technology systems, including our website, email system, and various other online processes and functions, are critical to our business and operations. The Company faces risks associated with cybersecurity, including operational interruptions, financial losses, personal information leakage and non-compliance risks.

companyName: Smart Powerr Corp.

ticker: CREG


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO"). Our CISO has formal education in information technology and extensive cybersecurity program management experience with over three decades of diverse experience in the chemicals and manufacturing industries and maintains various information security certifications. Our CISO is accountable for the enterprise-wide cybersecurity strategy for both information technology (IT) and operations technology (OT), including significant third-party risks. The cybersecurity team, led by our CISO, is responsible for policies, standards, architecture, tools, training and processes to keep Trinseo secure. Our CISO provides regular updates to our Digital Steering or Cybersecurity Steering management committees.

companyName: Trinseo PLC

ticker: TSEOF


text: For a description of the risks from cybersecurity threats that may materially affect us, see our risk factors under the heading "Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor titled "If our IT systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects."

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We have established a security team which is principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: During the period covered by this report, the risk from cybersecurity threats or incidents did not have a material impact on our strategy, results of operations, or financial condition. We expect that cybersecurity threats and incidents will continue to occur and any such cybersecurity incident impacting us could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including our ability to continue to service our members, any loss of or unauthorized access to data, lost revenue, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Cincinnati


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business.

companyName: MSD Investment Corp.


text: Despite our efforts to create security barriers to such threats, it is virtually impossible for us to completely mitigate these risks. In August 2020, we discovered ransomware on a server and engaged third-party forensics experts and outside counsel for incident response. We did not pay ransom to the attacker because the documents that were encrypted by the attacker were sufficiently backed up and the investigation further confirmed that no employee data or other personal information was accessed. We implemented a number of security enhancements as the incident unfolded and continue to implement short- and long-term security enhancements to further secure our network.

companyName: Quantum-Si Inc

ticker: QSI


text: The Audit Committee is provided with updates on technology and cybersecurity risks at least four times annually, including annual reviews of the Company's cybersecurity program and technology risks and controls, and bi-annual updates on operational risks (in spring and fall). Given its importance, the full Board is invited to attend the annual cybersecurity program and time is reserved at each Audit Committee meeting for cybersecurity technology matters that warrant discussion between the standing sessions. In addition, our Enterprise Risk Management team provides FIRMCo with an assessment of cybersecurity insurance risk once per year. The Audit Committee, FIRMCo and the full Board are apprised of developments in the external environment and business strategies that present additional potential cyber risk exposure to the Company, such as modifications to on-line platforms and expanded use of cloud-based applications, on an ongoing, as-needed basis. As a result, cybersecurity and cyber risk are typically discussed more frequently than the annual minimum requirements.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. Some or all of this work is done through our services agreement with Agenus. To date, we have not experienced any material cybersecurity incidents.

companyName: MiNK Therapeutics, Inc.

ticker: INKT


text: As described under Item 1A in this Form 10-K, we are subject to risks from cybersecurity threats, including risks relating to maintaining customer and employee data. Cybersecurity is a key focus at multiple levels of our organization, and we have developed policies and procedures to assess, identify and manage risks from cybersecurity threats.

companyName: CEDAR FAIR L P


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel, Chief Compliance Officer and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennslyvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: The Company's Information Security team coordinates with teams across the Company to prevent, respond to and manage security incidents, and engages third parties, as appropriate, to assess, test or otherwise assist with aspects of its security processes and incident response. A dedicated Supplier Trust team manages information security risks the Company is exposed to through its supplier relationships. The Company has processes to log, track, address, and escalate for further assessment and report, as appropriate, cybersecurity incidents across the Company and its suppliers to senior management and the Audit and Finance Committee ("Audit Committee") of the Board. The Company's enterprise risk management program is designed to identify, asse ss, and monitor the Company's business risks, including financial, operational, compliance and reputational risks, and reflects management's assessment of cybersecurity risks.

companyName: Apple Inc.

ticker: AAPL


text: We have identified certain third parties that we believe pose a higher cybersecurity risk to us because they have significant access to our systems or data. For these higher-risk third parties, we have implemented additional requirements, including: • We assess these higher-risk third parties' cybersecurity controls through a cybersecurity questionnaire and a review of their cybersecurity controls, either through independent audits or by direct review of their cybersecurity policies and practices. • We use third-party cybersecurity monitoring and alert services to monitor these higher-risk third parties.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, and financial risk areas.

companyName: LUB LIQUIDATING TRUST


text: We have implemented policies and procedures intended to manage and reduce cybersecurity risk that are integrated with the Enterprise Risk Management ("ERM") framework utilized by management and the Audit Committee to oversee our various top enterprise risks. We maintain an incident response plan that is designed to protect against, identify, evaluate, respond to and recover from a cybersecurity related incident. The plan provides for the creation of an incident response team in the event of an incident and it is designed to be flexible enough to accommodate a broad array of potential scenarios. The incident response team is a cross-functional group that may be composed of both Company personnel and external service providers, and that is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We conduct regular exercises to help ensure the plan's effectiveness and our overall response preparedness.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Technical Security Controls – We employ layered security controls, including Managed Endpoint Detection and Response, firewalls, intrusion detection systems, encryption technologies, and a Security Operations Center that is operated 24 hours a day, seven days a week.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: AFG utilizes a variety of techniques to provide for the availability of critical data and systems, maintain regulatory compliance, manage its material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents including, but not limited to, the following: • Conducts regular phishing testing of all employees and all members of the Board of Directors; • Utilizes full-desk encryption on all Company laptops and desktops; • Maintains a defense in depth security control strategy that is tested against high risk threats such as ransomware and other trending attack vectors; • Performs annual security awareness training and other routinely scheduled educational programming for employees; • Validates compliance with internal data security controls through the use of security monitoring utilities and internal and external audits; • Performs self-assessments measured against industry-leading cybersecurity frameworks for standards, guidelines and best practices, including the NIST cybersecurity framework; • Regularly scans external websites and internal applications; • Engages an external third-party to conduct an annual penetration test consisting of advanced adversarial attacks against company systems and from which findings are investigated, ranked by risk level and tracked through appropriate mediation levels; • Utilizes user protections including stringent password requirements, two-factor authentication, and timed logoffs; • Conducts regular network and endpoint monitoring; • Performs regular tabletop exercises, utilizing a third-party data security firm as a facilitator, to simulate a response to a cybersecurity incident where the Company uses the findings to improve its processes and technologies; and • Purchases information security risk insurance from a third-party insurer that provides protection against the potential losses arising from a cybersecurity incident.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Remediation Tracking. Remediation and tracking sheets are developed for all audit and assessment results. Progress is monitored by the Audit Department and reported to the Audit Committee of the Board of Directors regularly.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Comprehensive contingency and recovery plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident. These are tested on a regular basis against scenarios of varying degrees by both internal and external resources.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: Our risk assessment and mitigation procedures are centered on three key components: identification of risks, which involved input from different groups across our company;

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: With an increasingly technology-driven business landscape, cybersecurity is critical to safeguarding our company's shipboard and shoreside assets and maintaining our operational integrity. We have implemented cybersecurity measures that are designed to protect the confidentiality, integrity and availability of our information technology and operational technology systems against the constantly evolving cyber threats.

companyName: CARNIVAL PLC

ticker: CUK


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced minor cybersecurity incidents in the past though none that have had a material effect on the Bank's financial condition or results of operations.

companyName: Federal Home Loan Bank of New York


text: Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: OS Therapies Inc

ticker: OSTX


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to assess, identify, and manage material risks from cybersecurity (including cybersecurity threats associated with the use of third-party service providers), to safeguard our information systems, and to protect the confidentiality, integrity, and availability of the data on our information systems.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Cybersecurity Risk Management & Strategy Arrow has implemented processes designed to oversee and identify risk from cybersecurity breaches. Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its backup systems.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.

companyName: Sabine Pass Liquefaction, LLC


text: The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management ' s plans for monitoring and testing compliance with data security regulations.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: Our Senior Director of IT, as part of our overall cybersecurity function, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, or CFO, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other significant security-related incidents.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Executive Officer, who is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: Catalyst Crew Technologies Corp.

ticker: CCTC


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires and risk assessments for certain vendors, vulnerability scans for certain vendors, security assessment calls with certain vendor's security personnel, imposition of information security contractual obligations on certain vendors, verification of relevant industry standard security certifications for certain vendors, and other vendor management program elements. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: NeuroPace Inc

ticker: NPCE


text: In the event a security risk is detected, or a breach occurs, we are prepared with response protocols based on National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and guidelines for testing. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model that evaluates our security controls to help protect against attacker tactics, techniques, and procedures. See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors – If our information technology systems or data, or those of third parties upon whom we rely, are or were compromised, this could result in adverse consequences resulting from such compromise including but not limited to regulatory investigations or actions; litigation; fines and penalties; a material disruption of our drug development program; compromise sensitive information related to our business; harm our reputation; triggering our breach notification obligations; prevent us from accessing critical information; disruptions of our business operations; loss of revenue or profits; loss of customers or sales and expose us to liability or other adverse effects to our business."

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our Board, by way of our Risk Committee, oversees management of cybersecurity and other information technology risks. The Risk Committee receives periodic reports from management on our cybersecurity risks and control structure. In addition, management updates the Risk Committee, as necessary, regarding cybersecurity incidents.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: As discussed further in Item 1, Regulation, Enterprise Risk Management, we manage cybersecurity as part of our overall enterprise risk programs.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. Additionally, the Company's employees go through cybersecurity awareness training covering topics such as general cybersecurity best practices, phishing, data protection, password protection, and network security.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate such risks. The Board's oversight of major risks, including cybersecurity risks, occurs at both the full Board level and at the Board committee level through the Nominating and Corporate Governance Committee.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Our cybersecurity risk management methodology includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;

companyName: BioCorRx Inc.

ticker: BICX


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee and/or Board.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: It is responsible for (i) administering the Company's policies and procedures in conjunction with our third-party information technology provider, Fairdinkum ("IT Provider"); (ii) distributing our policies to employees and consultants and providing training; (iii) responding to employee or consultant inquiries regarding our policies; (iv) overseeing our cybersecurity program and leading incident response efforts;

companyName: Gaucho Group Holdings, Inc.


text: We contract with a third-party vendor (oversight for which is outlined in our Vendor Risk Management Policy) who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by employees, intrusion detection systems, third-party servicers or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the Head of Information Technology, the ORC and the CSIRT, which provides status updates to the Information Security Committee ("ISC"), with the frequency of such updates depending upon the perceived threat level of the reported incident.

companyName: Monroe Capital Income Plus Corp


text: Our CTO leads management's efforts to assess and manage cybersecurity risks through execution and enforcement of the Program, implementation of the ISP, reporting cybersecurity risks to senior managers of the Company, and meeting at least twice annually with the Board to discuss cybersecurity risks. The CTO works closely with the Company's Executive Committee and other senior managers, including through his participation in the Cybersecurity Risk Committee, Operational Risk Committee, and CIRT. In addition to the processes described above, our CTO leads a team of information security specialists to assist him meeting his responsibilities. He leads dedicated cybersecurity meetings with this information security team and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. Our CTO brings over 30 years of technological expertise to the Company, with a background deeply rooted in data management and protection, data analytics, and artificial intelligence and brings extensive experience in information security strategy and risk management from his previous roles at a global investment bank.

companyName: PJT Partners Inc.

ticker: PJT


text: Our management team meets with Connetic regularly to discuss then-current cybersecurity issues, which may include efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including threat intelligence and other information obtained from governmental, public or private sources, and external service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment including a spear-phishing report.

companyName: Peakstone Realty Trust

ticker: PKST


text: Engaging Third Parties in Risk Management. We use a combination of internal resources and external assessors, consultants and auditors to conduct our cybersecurity risk assessments and identification. We periodically examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology, as guidelines, along with compliance with our internal cybersecurity controls. We also work with third parties to assess our incident response preparedness and to manage and track our risks.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Our management team, including our Vice President, Digital and Information Technology and Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of managing public pharmaceutical companies, including their related information technology and cybersecurity risk management programs.

companyName: Verona Pharma plc

ticker: VRNA


text: On a periodic basis, but not less than annually, the Information Security Officer (ISO), in conjunction with the Information Technology department, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Information Security Officer, CIO and IT Department regularly meet to review, monitor and address technology related threats and emerging risks.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: c. Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

companyName: SEKISUI HOUSE U.S., INC.


text: Michelle R. Stewart, age 52, is Vice President, Chief Accounting Officer and Corporate Controller. Since joining Eastman in 1995, Ms. Stewart has served in a number of positions with increasing responsibility in the financial organization. Prior to joining Eastman, Ms. Stewart worked for the public accounting firm KPMG Peat Marwick. Ms. Stewart was appointed to her current position effective October 2021.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: One of the functions of our Board is to identify principal risks of the Company and ensure implementation of appropriate systems to manage these risks, including risks from cybersecurity threats. Our Board works with members of management to identify and manage these risks, including cybersecurity risks. We currently employ a qualified Director of Information Technology and Data Management Systems who reports to our Chief Executive Officer. This employee has over 20 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.

companyName: BIO-PATH HOLDINGS, INC.

ticker: BPTH


text: While previous cybersecurity incidents and threats have not materially adversely affected our business strategy, results of operations or financial condition to date, any actual or perceived breach of our security could damage our reputation or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, "Information technology interruptions and breaches in data security could adversely impact our business, results of operations and financial condition" for more information.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: Board is engaged in the oversight of cybersecurity threat risk management. Additionally, the Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Financial Officer. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As part of the Company's risk management strategy, we require that all employees complete regular data security and privacy trainings, and conduct phishing tests and specialized training such as secure coding training for our developers.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Cybersecurity risks are addressed as a component of our overall enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and to mitigate those cybersecurity threats that are more likely to lead to a material impact on our business. Features of our cybersecurity risk management program include: • Periodic risk assessments designed to help identify cybersecurity risks that could materially impact our Information Systems and Data; • A security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, information security controls, and response to any cybersecurity incident; • A cyber and data security incident response plan that establishes policies and procedures for identifying, managing, and recovering from a cybersecurity incident, including escalating tiers of notification depending on an incident's nature and severity; • Periodic tabletop exercises with management and other employees to discuss, prepare for, and simulate our responses to potential cybersecurity incidents; • The use of third-party service providers, as appropriate, to assess, test, and assist with aspects of our information security controls; • The use of a third-party risk management process for our service providers, suppliers, and partners; • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • Cybersecurity policies and procedures, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices; and • Required annual privacy and cybersecurity training (including spear phishing and other awareness exercises) for employees.

companyName: Vivid Seats Inc.

ticker: SEAT


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, distributors, supply chain resources and other consultants. We have vendor management processes to manage cybersecurity risks associated with our use of these providers. The processes include security assessment calls with certain vendor security personnel, conducting risk assessments for certain vendors and reviewing of security assessments. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: We have implemented best practices and established numerous controls to reduce cybersecurity risk. Some key components include: • Leveraging third-party cybersecurity vendors to test our systems, identify previously undiscovered risks in the environment and validate existing cybersecurity controls. We maintain a process to oversee and identify risks from cybersecurity threats associated with our use of third-party vendors with access to our resources. • Educating our users on cybersecurity prevention tactics through security awareness training and ongoing phishing testing. • Protecting Email through multiple layers of security that cover all internal and external communication. • Utilizing a patching and remediation process for our systems. We use a managed risk service to help detect and prioritize vulnerabilities found in the environment and track them for remediation. • Having a data recovery plan and controls designed to protect against business interruption, including multiple backups of our critical systems. • Deploying technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, access controls, extended detection and response, and event monitoring. • The company maintains a Cybersecurity Insurance Policy.

companyName: VOXX International Corp


text: Our CISO has more than 25 years of experience building and leading cybersecurity programs for global healthcare and retail companies. The cybersecurity leadership team reporting to the CISO is comprised of leaders with skills in cybersecurity risk management, cybersecurity architecture, identity and access management, and cybersecurity operations and engineering. Their experience and certifications are commensurate with their roles.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, employee reports, law enforcement reports, or other third-party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a cybersecurity operations team with round-the-clock monitoring, and the CIO and Director of Cybersecurity receive regular reports on industry activity. Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CIO along with the Director of Cybersecurity will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, Chief Administrative Officer and General Counsel and Executive Vice President - Manufacturing. The Company may engage third-party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, our Executive Vice President, Chief Administrative Officer and General Counsel, in consultation with the CIO and Director of Cybersecurity, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U.S. securities laws. Following a cybersecurity incident, the Executive Vice President and Chief Financial Officer will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: We employ information technology specialists and use external consulting firms to supplement our cybersecurity practices. Both the interim CEO and CFO have experience in managing teams of information technology specialists and assessing cybersecurity threats.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report for additional discussion about cybersecurity-related risks.

companyName: BRT Apartments Corp.

ticker: BRT


text: As previously disclosed in the Company's Current Report on Form 8-K filed with the SEC on December 11, 2024, during the fourth quarter of fiscal 2024, unauthorized activity on a portion of our information technology systems resulted in the Company experiencing certain operational disruptions, including with online ordering in parts of the U.S. (the "2024 Cybersecurity Incident"). Our online ordering, retail shops, and core business functions are now fully operational. The incident materially affected the Company's business operations and is reasonably likely to materially impact the Company's results of operations and financial condition. In the fourth quarter of fiscal 2024, we incurred approximately $3 million of remediation expenses related to the 2024 Cybersecurity Incident. In addition, we estimate that we lost revenue within our U.S. segment in an amount of $11 million related to the incident with a corresponding estimated $10 million impact on Adjusted EBITDA (includes margin on the aforementioned lost revenues, as well as operational inefficiencies). We expect to continue to incur costs in fiscal 2025 related to the incident, including operational inefficiencies early in the first quarter and costs related to fees for our cybersecurity experts and other advisors. The Company holds cybersecurity insurance that is expected to offset a portion of the losses and costs from the incident. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition. For more information regarding cybersecurity risks that have and may in the future materially affect us, see "Risk Factors—Risks Related to Cybersecurity, Data Privacy, and Information Technology" included in Item 1A of Part I of this Annual Report on Form 10-K.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: Our Deputy Chief Security Officer and Data Privacy Officer oversee our assessment, prevention, detection and management of cybersecurity risks, and report to our executive team, including our Chief Information Officer, Chief Financial Officer and Chief Legal Officer. Collectively, they have expertise in cybersecurity, privacy law and regulation, and governance, and their teams comprise personnel with a broad range of experience across the private and public sectors, the technology industry, and in different geographic regions. Our Deputy Chief Security Officer Security has over 25 years of experience in multiple business verticals and has led security organizations and managed global practices for Fortune 500 technology companies. He became our Deputy Chief Security Officer after previously serving in that role at ironSource, prior to its merger with us.

companyName: Unity Software Inc.

ticker: U


text: b.a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Senior management with primary oversight responsibility for day-to-day cybersecurity risk management includes our Chief Executive Officer, Chief Financial Officer, Director of Information Technology, General Counsel, Corporate Controller, and Chief Accounting Officer. The group's collective education and experience informs our cybersecurity risk assessment and management process and includes, among others, the following: higher education degrees (including master's level or equivalent) in computer science and/or technology; decades of experience in the information technology and computer science field; experience configuring and maintaining firewalls, VPNs, and endpoint security frameworks for sophisticated, multinational organizations; proficiency in programming languages; certifications as developers and network engineers; and responsibility for managing large-scale international implementations of enterprise resource planning software systems for global companies.

companyName: HURCO COMPANIES INC

ticker: HURC


text: Our Vice President of Information Security has served in various roles in information technology and information security for over 27 years, including as Vice President of Information Security for large public companies. In addition, our Vice President of Information Security has previously held roles including Vice President of Information Security and Technology, Senior Director Information Technology, Director IT Security and Compliance, and Senior IT Audit Manager. Our Vice President of Information Security holds several certifications including CISSP, CISA, CISSM, and PCI-ISA. Our Vice President of Information Security holds a B.S. in Management Information Systems from Iowa State University and an MBA from Auburn University.

companyName: VAIL RESORTS INC

ticker: MTN


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.

companyName: Blue Owl Capital Corp II


text: We utilize various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. We obtain System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the ISO 27001 international standard for Information Security and we evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: NVIDIA CORP

ticker: NVDA


text: The Bank's Operational Risk Oversight Committee ("OROC"), led by the CRO, provides oversight of the Bank's operational risk, including cybersecurity risk. OROC meets quarterly and is comprised of senior leaders from the IT (including Security), Legal, Accounting, and Operational Risk Management departments, among others. In addition, matters of cybersecurity importance relating to specific IT projects are discussed and addressed in the Bank's Information Technology Steering Committee, which is led by the CIO and is comprised of senior leaders from across the Bank.

companyName: Federal Home Loan Bank of Dallas


text: The Director of Information Technology, along with members of management, inform the Audit Committee on cybersecurity risks by providing periodic updates regarding (i) Status of ongoing cybersecurity initiatives and strategies, (ii) The overall state of the Company's security program and potential exposure to risks, and (iii) Incident reports and learning from any cybersecurity events. Further, the Director of Information Technology maintains an open dialogue regarding any significant developments in cybersecurity risks, ensuring the Audit Committee's oversight is proactive and responsive. In addition to periodic updates to the Audit Committee, the Director of Information Technology, in his capacity, regularly informs the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") regarding matters related to cybersecurity risks and incidents. This ensures the highest level of management are informed of potential risks associated with cybersecurity that could have a material and adverse effect on the Company.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: We utilize a comprehensive, multi-layered approach for our cybersecurity management which is generally aligned with the National Institute on Standards and Technology Cybersecurity Framework. We have a number of controls and procedures in place to recognize potential cybersecurity threats and potential incidents and elevate such potential incidents to senior management and our outside advisors to determine the scope and materiality of such incidents. Automated tools and our third party security operation center provide alerts to our cybersecurity staff regarding potential threats. We also use an array of defenses to protect our cybersecurity environment and mitigate cybersecurity threats, including multi-factor authentication, access controls, email filtering, firewalls, intrusion prevention and detection systems, partitioning and encryption of information, backup and data recovery procedures, malware defenses, disaster recovery and incident plan responses, hardware and software updates and patching, and related programs. We regularly assess the efficacy of these defenses and mitigation measures and implement improvements, focusing on critical matters and threats. To further promote a culture of cybersecurity awareness and defense, we also have regular educational and training sessions for our relevant employee population about the importance of cybersecurity and our key information more generally.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our Information Security Program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Director of Information Technology.

companyName: BayCom Corp

ticker: BCML


text: They oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which the executive team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: • They provide briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. • In addition, they provide briefings of any significant cybersecurity matters to the board of directors as well as an annual update of cybersecurity risks and activities.

companyName: Innoviva, Inc.

ticker: INVA


text: We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our information security risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.

companyName: Kearny Financial Corp.

ticker: KRNY


text: Our Chief Information Security Officer reports to our Chief Legal Officer, who has served in that position since December 2017. Our Chief Legal Officer manages our cybersecurity function and legal matters affecting our company and risk management within the company. Our Chief Legal Officer's responsibilities also include overseeing legal support for corporate governance, financial reporting, litigation, mergers and acquisitions and commercial contracts, regulatory and general compliance matters at our company and management of our government affairs function.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: The Company's Chief Information Security Officer reports to the Company's Chief Information Officer who is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Chief Information Security Officer works in coordination with Company management. The Company's Chief Information Security Officer has served in various roles in information technology and information security for 25 years, including several Fortune 500 companies as a consultant specializing in risk management and security architecture, VP of Engineering for a payment solutions provider and security principal for an international telecommunications company in the Fortune 100, and has held many of the information security industry's most advanced certifications including ISC2's CISM (Chief Information Security Manager) and CISSP (Chief Information Security Professional), as well as an early adopter of the Cloud Security Alliance's CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer has served in various roles in information technology for 21 years.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of its general risk oversight function. The Board satisfies its responsibility to oversee cybersecurity risk through full reports by the Chair of the Audit Committee regarding such committee's considerations and actions, as well as through regular reports directly from officers responsible for oversight of risks. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board and the Audit Committee receive periodic reports, summaries, and presentations from our senior management, including the Chief Information Officer and Global Head of Cybersecurity, concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: We have formed and maintain 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that continually monitors our key systems have an Incident Response (IR) and escalation process that is designed to detect cyber incidents and react in an appropriate manner to reduce any related damage.

companyName: Rumble Inc.

ticker: RUM


text: The Customers' Directors' Risk Committee receives a quarterly Cybersecurity Risk Indicators report from the CISO, which provides information on cyber risk, vulnerabilities, disaster recovery testing, employee security awareness training, and Third-Party cybersecurity risk. An annual report titled, "The State of Security" is compiled and shared with the Customers' Directors' Risk Committee summarizing the previous year's activities and offering a comprehensive view of trends and the risks they pose. Customers' security policies are reviewed and ratified annually by the Board of Directors, who oversee executive-level enforcement and compliance. Customers also engages several global external advisors to ensure the appropriate security posture, adherence to established controls, proper risk assessment, and efficient operation of its cybersecurity discipline. The Customers' Board of Directors includes a vetted board member with expertise in information security across various domains.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Education, training and preparedness are important elements of our cybersecurity program. Peloton requires new employees to undertake a cybersecurity training and provides regular training updates to other employees. Additional trainings are mandatory for those employees who handle confidential (including personal) information.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: Overview and Leadership Our enterprise risk management framework addresses cybersecurity risk along with other risks as part of our overall enterprise risk management process. We maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology to support our information technology systems and detect, identify, prevent, defend against and mitigate information technology and data security risks. Our cybersecurity program is aligned with the National Institute of Standards and Technology Cybersecurity Framework. This framework encompasses key processes, policies and controls to ensure protection, detection, identification, response and recovery capabilities across our organization.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risk management. Our Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance, and cybersecurity, including oversight of security teams. The Audit Committee is responsible for overseeing that management has processes in place designed to identify, assess and manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. The Audit Committee also reports on the cybersecurity program to our Board.

companyName: Rapid7, Inc.

ticker: RPD


text: We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity threats and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation.

companyName: BankUnited, Inc.

ticker: BKU


text: The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members from both TKO and Endeavor. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to TKO's Cybersecurity Executive Steering Committee, which includes TKO's Chief Administrative Officer, Chief Legal Officer, Chief Financial Officer, Deputy Chief Financial Officer, Chief Accounting Officer, Chief Product & Technology Officer, Corporate Secretary and Head of Investor Relations, as well as Endeavor's Chief Financial Officer, Chief Accounting Officer, Chief Legal Officer, Chief Compliance Officer, Chief Information Officer, SVP, Internal Audit, SVP, Global Privacy & Cybersecurity, SVP, Cybersecurity, SVP, Head of Corporate Security and Chief Communications Officer. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. The company's information security team is responsible for the day-to-day management of the company's global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The global information security team also develops training for personnel (e.g., employees and contractors) with access to Corteva's system to support adherence to the company's policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.

companyName: Corteva, Inc.

ticker: CTVA


text: Our Audit Committee and our Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks. In addition, our Board receives regular cybersecurity reports, which include a review of key performance and risk indicators, test results and related remediation and recent threats and how the Company is managing those threats.

companyName: GXO Logistics, Inc.

ticker: GXO


text: The company primarily manages risks for cybersecurity threats associated with its third-party service providers through evaluations and assessments during vendor selection, contract negotiations and contract renewals.

companyName: Century Communities, Inc.

ticker: CCS


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's operations and are based on recognized frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: LKQ CORP

ticker: LKQ


text: The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: PlayAGS, Inc.


text: Jack Henry's information and cybersecurity program is a core component of our overall enterprise risk management framework. It is maintained by a team of highly skilled cybersecurity professionals and supported by investments in modern technology, including artificial intelligence and machine learning. The program is designed to safeguard Jack Henry and client confidentiality and privacy by systematically identifying, assessing, and managing material risks and cybersecurity threats through comprehensive cyber defense, threat and vulnerability management, and cyber intelligence. It includes continuous enterprise monitoring and well-defined and regularly tested business resilience and incident response procedures. We also engage third-party vendors and consultants to assist in identifying, assessing, and mitigating cybersecurity risks.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: D.R. Horton's CSRO has more than 23 years of experience working in information technology and cyber security roles including software development, identity and access management projects, privilege account management and multifactor authentication implementations. While in those roles, the D.R. Horton CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The D.R. Horton CSRO currently reports to the D.R. Horton CIO.

companyName: Forestar Group Inc.

ticker: FOR


text: As part of our cyber incident response plan, we utilize an established framework to assess the severity of cybersecurity incidents. Under the plan, incidents are escalated to relevant senior management, and the board of directors, as appropriate, based on their severity. Our disclosure committee assesses the materiality of severe incidents including both quantitative and qualitative factors.

companyName: lululemon athletica inc.

ticker: LULU


text: Industry-Standard Security Frameworks: We adhere to recognized security frameworks, including the National Institute of Standards and Technology (NIST), and employ controls such as antivirus and anti-malware protections, multi-factor authentication (MFA), complex password policies, patch management, email security solutions, and firewall protections.

companyName: Korth Direct Mortgage Inc.


text: Members of the Enterprise Information Security Steering Committee also include the Global Data Privacy Officer, Chief Technology Officer, Chief Administrative Officer, the General Counsel and the Global Risk Officer of Protiviti.

companyName: ROBERT HALF INC.

ticker: RHI


text: Third-Party Risk Management BancPlus engages third party assessors, consultants and auditors in connection with the Company's information security program, including to conduct external penetration testing, independent audits, and risk assessments. BancPlus also utilizes third party service providers in the ordinary course of business. The Company has implemented controls designed to identify and mitigate cybersecurity threats associated with its use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. The Company uses a variety of inputs in such risk assessments, including information supplied by providers and third parties who assist in such risk assessment. In addition, the Company requires its providers to meet appropriate security requirements, controls, and responsibilities and investigate security incidents that have impacted the Company's third-party providers, as appropriate.

companyName: BANCPLUS CORP


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery plans, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, and penetration testing.


text: The Board is actively engaged in oversight of our cybersecurity practices, with the Audit & Compliance Committee having primary oversight responsibility. The Audit & Compliance Committee reviews and approves the information security program on an annual basis, as well as receives management updates about information security matters on at least a quarterly basis. Additionally, the full Board receives regular presentations by our CISO regarding pertinent cyber and information security topics. These updates cover external cybersecurity hot topics and notable events, current and emerging threats, cybersecurity program achievements and progress on key initiatives, key performance indicators, key risk indicators and notable internal events. In addition, the Audit Committee receives prompt reporting and updates on significant cybersecurity-related incidents.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: As part of our overall cybersecurity risk management program, the Company maintains cyber insurance coverage, and we periodically meet with our insurer to discuss emerging trends in cybersecurity. While we believe our cyber insurance coverage provides commercially reasonable levels of coverage, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Executive Officer, and Chief Financial Officer.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: PagerDuty, Inc.

ticker: PD


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the audit committee of our board of directors (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly reports from the Vice President of Operation & Information Technology, and Head of Information Technology on our cybersecurity risks.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: We have integrated these cybersecurity processes into our overall risk management framework, systems, and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Beneficient

ticker: BENF


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any cyber security incident.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: The functions that report to our SVP-GIS include: cybersecurity risk management, Payment Card Industry compliance, and security testing; operation of protective security tools and systems; security monitoring, incident response, and digital forensics; security research and development and support for information technology and security functions.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The IT Committee and Audit Committee are the principal board committees that oversees the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.

companyName: RBB Bancorp

ticker: RBB


text: Our cybersecurity risk management is designed to employ technology and security practices across our operations and business functions, including vulnerability assessments, detecting and responding to cybersecurity incidents, cybersecurity crisis preparedness and incident response resources, vulnerability scans and IT security risk assessments, and progressive investments in cybersecurity infrastructure and technology designed to reduce cybersecurity risks. Notable aspects of our cybersecurity risk management include: efforts towards adoption of the National Institute of Standards and Technology (NIST) Cybersecurity periodic IT risk assessments conducted by an external cybersecurity consultant; management; Information Event Management (SEIM) and Security Operation Center Incident Response; management; security and privacy measures;

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business—Failure of a key information technology system, process or site, cyberattacks, or other deficiencies in our cybersecurity could have an adverse effect on our business and operations."

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Change Management and ITSM – The Company employs robust change, incident and problem management practices across core network, managed services, and information technology environments. Security team members are an active part of these processes.

companyName: CINCINNATI BELL INC


text: Linde is implementing a series of security enhancements based on the Zero Trust principle. Linde maintains a Standard Operating Procedure for Global Security Incident Response that defines how Linde responds to cyber incidents, including escalation, reporting and remediation procedures. Dedicated cybersecurity teams conduct surveillance for potential threats and implement both procedural and technological controls to protect data and to maintain safe, uninterrupted operations. The company engages third parties in connection with these efforts to provide independent analysis and advice on cybersecurity risks, incidents and other cyber security related matters. In addition, to help our people recognize information and cybersecurity concerns and respond accordingly, Linde conducts mandatory trainings and cybersecurity awareness programs for employees.

companyName: LINDE PLC

ticker: LIN


text: The Company's Board of Directors has delegated to the Audit Committee oversight responsibility for information technology risks, including cybersecurity and data security risks and mitigation strategies. The Audit Committee at least annually receives reports from the Senior Vice President, Chief Information Security Officer (CISO) concerning the Company's cybersecurity and data security risks, including ongoing efforts to prevent, detect, monitor, remediate and manage such cybersecurity threats, the threat environment, incident updates and emerging cybersecurity practices and technologies. The Chair of the Audit Committee reports on its discussion, including concerning cybersecurity matters, to the full Board. In addition, from time to time, senior management briefs the Audit Committee, the Audit Committee Chair and the Board on cybersecurity matters potentially of interest, including cybersecurity events, regulatory disclosures and regulatory trends.

companyName: Walt Disney Co

ticker: DIS


text: To date, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect us or our strategy, financial condition, liquidity or results of operations. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN