text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: Company engages a third-party provider to maintain our systems and management participates in the assessment to identify any risks from cybersecurity threats. Our third-party provider monitors our firewall, network, system security and internal and external backups and reports any issues to the Company.

companyName: Nexentis Technologies Inc.

ticker: NXTS

secItem: Item 1C


text: Although we have not experienced any material cybersecurity events to date, new advanced cybersecurity threats and attack vectors could materially affect our business strategy, results of operation or financial condition, as further discussed in the risk factors "Disruption, failure, data corruption, cyber-based attacks or security breaches of our IT systems could adversely affect our business and results of operations" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: Our advisor's Information Technology Director has over 15 years of prior management experience in digital technologies. He has over 10 years of experience in creating and implementing procedures for managing Payment Card Industries Security Standards (PCI), SOX Cybersecurity measures to include ransomware, email phishing, and data breaches, and bringing into effective action the five pillars of the NIST Cybersecurity Framework.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Business Manager and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Business Manager and our critical third-party vendors (including the transfer agent) and other partners.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: In the event of an incident, we intend to follow our cyber incident response plan. Any assessment that is deemed an actionable incident would trigger an alert to the CIRT. The CIRT will further assesses the incident according to a predefined scale (e.g., low, medium, high and critical) and initiate the Company's incident response plan and communication protocols. The CIRT, in conjunction with the Risk and Sustainability Committee, will assess the materiality of the incident with respect to the rules, regulations and disclosure requirements of the SEC and NYSE. See "Risk Factors" in Item 1A of this Annual Report. As of December 31, 2024, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: We face cybersecurity risks due to the breadth of networks and systems we must defend against cybersecurity attacks and threat actors seeking to inflict harm on us; and the substantial level of harm that could occur to us were we to suffer impacts of a material cybersecurity incident. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2024, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures and increased cybersecurity insurance premiums, defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we and our suppliers may be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: Risk Assessment and Threat Intelligence: Under the oversight of the Chief Information Officer (CIO), we conduct periodic risk assessments to pinpoint potential cybersecurity vulnerabilities and threats. These assessments entail evaluating the security posture of critical systems, networks, and applications, as well as analyzing the potential impact of cybersecurity threats on our business operations, financial condition, and reputation. Additionally, we perform continuous threat monitoring and deployed monitoring systems, encompassing technologies such as intrusion detection systems, security information and event management tools, and threat intelligence programs.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: In the last three years, we have not experienced a material information security breach incident, or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.

companyName: Volato Group, Inc.

ticker: SOAR


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.

companyName: OOMA INC

ticker: OOMA


text: We have invested in monitoring tools, security infrastructure, and employee training programs to mitigate risks and adapt to this evolving landscape.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Although Trustmark has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that Trustmark will not experience such an incident in the future. For additional information regarding the risk Trustmark faces from cybersecurity threats, please see the risk factors titled "Trustmark may experience disruptions of its operating systems or breaches in its information system security" and "Trustmark must utilize new technologies to deliver its products and services, which could require significant resources and expose Trustmark to additional risks, including cyber-security risks" included in Part I. Item 1A. – Risk Factors of this report.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Material Impact on Company During 2024, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: CVR ENERGY INC

ticker: CVI


text: Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable. Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Data Security.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: When appropriate, we also engage third-party service providers to evaluate, test, or assist with specific elements of our cybersecurity risk management program. For instance, we utilize external assessors, including security researchers and penetration testers, to identify and report vulnerabilities in our information systems.

companyName: Compass, Inc.

ticker: COMP


text: As one of the critical elements of the Company's overall CRM approach, the Company's cybersecurity program is focused on the following key areas:

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: Our CIO (who has 15 years of cybersecurity experience), our Director of Global IT Security and Compliance (who has 11 years of cybersecurity experience and 25 years in IT), and our Associate Director of Global Cyberseurity (who has 26 years of cybersecurity experience) are the members of our management team who are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO is a member of the Incident Response Team, and the Director of Global Cybersecurity is a member of our internal IT Security Team and the Incident Response Team.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: The Company assesses cybersecurity risk and exposure on an ongoing basis and implements tools that are commensurate with the risks that the Company faces. In light of the Company's relatively small size and personnel, it relies heavily on reputable third-party vendors to mitigate key cybersecurity risks and exposures. While the nature of the Company's business and the data it processes inherently limit the Company's exposure to cybersecurity risk, the Company has implemented and maintains controls, policies, procedures and safeguards to maintain and protect confidential information as well as the integrity, continuous operation, redundancy and security of all information technology systems and data used in connection with the Company's business. The Company generally approaches cybersecurity threats through a comprehensive approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Farmland Partners Inc.

ticker: FPI


text: Management's Role in Cybersecurity Risk Management Our management, including the COO and CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, IT management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: The Company's Information Security Officer (ISO) is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and information security issues that may affect the Company. In addition, the ISO regularly reports the status to Executive Management.

companyName: LAKE SHORE BANCORP, INC.


text: Cybersecurity is an integral part of the Company's Enterprise Risk Management ("ERM"). In order to manage technology risk and secure technology ecosystems, our information security framework is based on the National Institute of Standards and Technology ("NIST") principles, which we execute through our adherence to the Center for Internet Security ("CIS18") control framework. The CIS18 framework provides us the ability to align measurable controls to actions and benchmark against recognized standards. Using these recognized industry standards, we approach cyber risk management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks. Following our multi-pronged approach to protecting our systems and data, we: • administer monthly mandatory ongoing information security training for all employees throughout the year; • maintain security protocols and internal security controls; • maintain a privacy policy that governs our collection, processing, and securing of personal information; • limit collection and storage of information regarding our customers, suppliers and employees; • use a zero trust network that verifies the device and user identity while restricting network access to only what is needed; • limit access to network resources to only devices that are owned and administered by the Company; • require multi-factor authentication for all employee user accounts; • maintain application-aware firewalls to limit cyberattack access to data; • use data breach detection software and a cybersecurity operations center that actively monitors our systems; • conduct internal technical cyber incident exercises with our information security team and our third-party cybersecurity service providers; and • conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address identified deficiencies in our security program.

companyName: Meritage Homes CORP

ticker: MTH


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. As the historic external property manager of the VineBrook Portfolio and a current subsidiary that engages in property management functions and employes the majority of our employees, we maintain cybersecurity policies, standards, processes and practices at the Manager that cover our 24 office locations and over 550 employees. In general, we seek to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing our information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: VINEBROOK HOMES TRUST, INC.


text: Response Planning: Having a comprehensive and well-rehearsed incident response plan is crucial to minimize damage during a breach. Management plays a vital role in developing this plan, training personnel, and guiding the response when needed.

companyName: DecisionPoint Systems, Inc.


text: Oversee Third-party Risk We maintain standard processes to oversee and manage risks associated with use of third-party service providers. We conduct security assessments of third-party service providers with access to our information systems or sensitive data before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Such practices include recurring assessments of critical third-party service providers' cybersecurity programs and ongoing monitoring, detection, and response capabilities used by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-party service providers. In addition, our Legal team reviews the associated vendor contracts to ensure they include appropriate terms, including applicable security provisions.

companyName: HashiCorp, Inc.


text: The management of the Company is responsible for overseeing risk for the Company and has delegated to the VP, Engineering & Technology ("VPE&T") the responsibility for overseeing the cybersecurity risk management strategy for the Company. Management receives regular updates on our cybersecurity risk management process from the VPE&T. The VPE&T reviews our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol that provides for the notification, escalation and communication of significant cybersecurity events to the management team. Company's cybersecurity program is overseen by our VPE&T, who is responsible for global information technology, including cybersecurity.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: General Manager, who is responsible for overseeing our business operations, with oversight from senior management and the nominating and the Corporate Governance Committee of our Board are responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. We also use the services of an outside consulting firm to monitor activity and advise the company of cybersecurity protocols.

companyName: ENvue Medical, Inc.

ticker: FEED


text: Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks.

companyName: Citi Trends Inc

ticker: CTRN


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. These investments include best practice applications such as CrowdStrike, Okta, Intune and Kandji. These tools also strengthen our overall IT posture as well as our monitoring and alerting and patching processes. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the continuous monitoring such as National Institute of Standards and Technology ("NIST"). We execute an NIST 800-53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.

companyName: Fluent, Inc.

ticker: FLNT


text: The Company's cyber risk management program is designed to identify, track, escalate, remediate, and report cybersecurity risks across the Company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. The Company has a vendor management program that evaluates and oversees cybersecurity risks related to third party vendors providing services to the Company. Any identified risks are assessed, prioritized, and addressed via process, technology, and personnel improvements to help ensure ongoing mitigation and tracking.

companyName: Dave Inc./DE

ticker: DAVE


text: As noted, to operate our business, we utilize certain third -party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Currently, our Chief Financial Officer is expected to lead our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our Chief Financial Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties, employees and their beneficiaries, and customers) and other data. These incidents have not had a material impact on our services, system, or business during the past reporting period. However, despite our capabilities, processes, and other security measures we employ, we may not be aware of all vulnerabilities or might not accurately assess the risk of an incident. Additional information on cybersecurity risks we face can be found in Item 1A. Risk Factors, which should be read in conjunction with the foregoing information.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: We have implemented policies and programs to secure sensitive data. These include: • Data security policies for the Company and its subsidiaries; • Frequent security training; • Establishing controls over network devices, actively tracking, monitoring, and evaluating them for new, missing, or updated software needed to strengthen security, patch known vulnerabilities, or stabilize software or operating system issues; • Protecting sensitive data through encryption techniques; and • Utilizing systems with backup and recoverability principles, such as periodic data backups and safeguards in case of a disaster.

companyName: Pennant Group, Inc.

ticker: PNTG


text: While we believe our cybersecurity and privacy program to be appropriately designed in light of the risks we have identified, we have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. See "Risk Factors—Our solutions or our third-party cloud providers have experienced in the past, and could experience in the future, data security breaches, which could adversely impact our reputation, business, and ongoing operations."

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: The deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. If necessary, the use of third-party security experts if and when an incident is detected.

companyName: SOLESENCE, INC.

ticker: SLSN


text: In the ordinary course of business, our board of directors receives annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Our Information Technology Steering Committee consists of members of the Executive Management Team and department heads with relevant technology experience, and meets on a bimonthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Technology Committee which also meets on a bimonthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Directors Technology subcommittee or Audit Committee sooner than its next bimonthly update.

companyName: Community West Bancshares

ticker: CWBC


text: As part of our overall risk management system, we monitor and test our safeguards, including through annual third-party vulnerability assessments. We train our employees on these safeguards, in collaboration with human resources, IT, and departmental management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plan.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our VP of Information Technology, who reports to our General Counsel & Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: We use third-party service providers to perform a variety of functions throughout our business, including hosting providers, CROs, and CMOs. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes, as appropriate, risk assessments of vendors, reviewing our vendors' information security program, reports, audits, and imposing relevant contractual obligations on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Y-mAbs Therapeutics, Inc.


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Privacy of Customer Information and "– Cybersecurity" included in Part I. Item 1 – Business of this report.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: As a result, we have implemented a multi-layered cybersecurity program that includes administrative, physical, and technical measures to protect our information systems. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: We actively assess, identify, and manage material risks associated with cybersecurity threats. Our information security, finance, procurement, legal and other cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. All employees are required to complete annual information security training and periodic training specifically related to phishing. We have an enterprise-wide Information Security Incident Response Plan ("Incident Response Plan") which describes the detailed processes and procedures that should be followed in the event of an information security incident. We periodically perform tabletop exercises with management participation to be able to effectively respond to an information security incident and evaluate and improve the Incident Response Plan. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection and vulnerability tools.

companyName: Bark, Inc.

ticker: BARK


text: To prevent unauthorized access, we have established a series of security gates across all production environments and instances two individuals have update access to production database instances, and a limited number of individuals have read-only access to our cloud environments, 2-3 members of our Platform Engineering team have access to production and test instances, and logs are generated for any changes made Risk Management: We maintain multiple AWS and Google Cloud environments, each with three sets of development, testing, and production environments. Our primary data warehousing solution is Amazon Redshift, while we use Amazon S3 Glacier for archival storage and Amazon S3 for object storage. We also employ Amazon Sagemaker for machine learning tasks and internally host Apache Superset on the AWS platform for data visualization.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: Cybersecurity matters are an important part of reporting to our board of directors, executive management team, risk committee and disclosure committee. From a board perspective, the audit committee oversees the company's cybersecurity efforts along with additional oversight from the entire board. Several members of the audit committee have obtained certifications in cybersecurity oversight. Each quarter, the chief information officer and chief information security officer report to the audit committee on cybersecurity risks and controls. Also occurring each quarter, the entire board, and our senior executive team, as appropriate, receives a comprehensive report from the chief risk officer on the status and management of risk and other metrics relative to identified tolerances and limits, risk assessments and risk plans. Additionally, the chief risk officer has direct access to all members of the board of directors and presents in person at board meetings twice each year.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. These plans address the prevention, detection, mitigation, and remediation of incidents, and include appropriate timely incident escalations to be followed during an incident.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: The Company has an Enterprise Risk Management ("ERM") program to address enterprise risks, and cybersecurity is a risk category evaluated and identified by that function. One of the leaders of the ERM process is Kellanova's Vice President, Internal Audit, and the process includes individuals with designated areas of focus and subject matter experts across Kellanova, including cybersecurity leaders. As the enterprise risk owner for cybersecurity, the Chief Digital and Information Officer supports the Chief Information Security Officer ("CISO") and the information security team, which includes a Governance, Risk, and Compliance (GRC) function, to manage cybersecurity risk. The information security team collaborates on privacy and security governance.

companyName: KELLANOVA


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see " Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, services, and data " in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. bioAffinity acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information on cybersecurity risks see Item 1A. "Risk Factors – Our internal information technology systems, or those of our third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our diagnostic tests' or therapeutic product candidates' development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: bioAffinity Technologies, Inc.

ticker: BIAF


text: Mr. Higgins recently announced his intention to depart our company effective February 21, 2025 and, as a result, Eric Young, our Senior Vice President of Engineering, will act as our interim CISO while we conduct a search for a permanent replacement. Mr. Young has more than 25 years of experience working in the technology industry across a diverse range of business sectors and since June 2023 has overseen Mr. Higgins and our engineering security team, which comprises personnel with a broad range of experience in cybersecurity, information technology, and risk management. During Mr. Young's tenure at Snap, Mr. Young has been involved in our approach in assessing, identifying, and managing security incidents.

companyName: Snap Inc

ticker: SNAP


text: We use external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls.

companyName: Jet.AI Inc.

ticker: JTAI


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when an unexpected cybersecurity incident occurs. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our internal procedures dictate that we evaluate and evolve our security measures as appropriate. Identifying, assessing, and managing cybersecurity risk is integrated into our overall internal controls approach. Additionally, we have in place cybersecurity and data privacy policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.

companyName: DUOS TECHNOLOGIES GROUP, INC.

ticker: DUOT


text: As a VIE that is 50.1% held by FE, we rely on, and are supported by, FirstEnergy's cyber security risk management program.

companyName: FirstEnergy Transmission, LLC


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – Cybersecurity" although we do not currently believe that such a result is reasonably likely.

companyName: AB Private Lending Fund


text: ALL platforms should have MFA enforced, any platform not supporting MFA in 2024 is deemed high-risk and immediately replaced as it is obsolete and poses high-risk to the Company.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Our cybersecurity risk management program is integrated into the broader scope of Kaltura's enterprise risk management framework, including processes for managing risks, from legal and compliance to strategic, operational, and financial threats, through shared methodologies, reporting channels, and governance processes.

companyName: KALTURA INC

ticker: KLTR


text: Horizon engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third–party specialists. It also maintains a third–party risk management program designed to identify, assess, and manage risk, including cybersecurity risks, associated with external service providers and our supply chain.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The protections, procedures, and controls set forth in the NIDSP Guidelines demonstrate the Company's attention to and prioritization of cybersecurity as a component of its overall strategy and system for managing risks. The NIDSP Guidelines include five policies described below, that together define the Company's strategy and practices for managing cybersecurity threats and mitigating cybersecurity risks.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Management and Strategy have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: Management and Board Oversight of Cybersecurity Risks Our Cybersecurity Program is managed by our Director of Information Technology, who leads our Information Technology team responsible for implementing our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Information Technology provides periodic reports to the executive risk management committee, the board-level risk committees of the Company and the Bank and the Chief Executive Officer and other members of our senior management, as well as the cross-functional management team that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents.

companyName: BayCom Corp

ticker: BCML


text: Our Senior Vice President, Information Technology and our Director of Information Security are together responsible for the day-to-day management of our cybersecurity risks. These professionals have extensive experience in the information technology area, including cybersecurity. In particular, our Senior Vice President, Information Technology has more than 30 years of professional experience in the field of management information systems and information security, including with other companies in our industry. Further, our Director of Information Security has more than 20 years of experience in the information security area, with a career spanning roles with the U.S. Air Force, healthcare, academia and private consulting, and holds various certifications related to cybersecurity.

companyName: Construction Partners, Inc.

ticker: ROAD


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Enterprise Information Security Steering Committee utilizes a CIRP to: (1) prepare for and protect against cybersecurity incidents; (2) detect and analyze cybersecurity incidents; and (3) contain, eradicate and appropriately report on cybersecurity events. In the event of a cybersecurity incident, the CIRP provides a framework to coordinate the response. The CIRP also addresses escalation protocols to senior management with respect to disclosure determinations related to a cybersecurity incident and provides for Executive Team briefings as appropriate. If the CIRP's initial investigation of the facts of a cybersecurity incident indicates the need for escalation for potential disclosure, the process in the Cyber Disclosure Procedure will be utilized, The Cyber Disclosure Procedure establishes a flexible and context dependent process for determining whether a cybersecurity incident ("Incident") constitutes a material issue pursuant to the rules and regulations of the Securities and Exchange Commission ("SEC"). A committee of senior management personnel is established to assess potential cybersecurity Incidents. Standing members of the Cyber Disclosure Committee ("CDC") include President and Chief Executive Officer, Chief Financial Officer, General Counsel, Global Privacy Officer and Chief Technology Officer.

companyName: ROBERT HALF INC.

ticker: RHI


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and data related to our customers, consumers and employees. Our cybersecurity risk management program leverages the National Institute of Standards and Technology Cyber Security Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our cyber security team regularly reviews enterprise risk management-level cybersecurity risks, and key cybersecurity risks are incorporated into our Enterprise Risk Management program. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include cyber security guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the Internet, social media, email and wireless devices.

companyName: Fossil Group, Inc.

ticker: FOSL


text: We have established an incident response team, which is led by our IT, legal, and compliance leaders and is comprised of stakeholders from various departments in the Company. A designated member from our IT team is responsible for conducting incident assessments, determining severity levels, informing relevant stakeholder, such as the incident response team and senior management, and maintaining documentation of the remediation activity.

companyName: SI-BONE, Inc.

ticker: SIBN


text: The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Director of Information Technology updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends, updates to threat monitoring processes, the composition of the Company's information security team, cybersecurity awareness training and testing, cybersecurity strategy, and cybersecurity metrics, and assesses the progress of cybersecurity programs, and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: Our cybersecurity function is overseen by our Senior Vice President of Information Technology, who leads a team that is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Disclosure of Management's Responsibilities Transformation and Chief Information & Digital Officer The Transformation and Chief Information & Digital Officer under the direction of the Company's Chief Executive Officer, is responsible for overseeing the Company's information technology systems, digital capabilities, and cybersecurity practices. The CSO, under the direction of the Transformation and Chief Information & Digital Officer, is responsible for overseeing the cybersecurity organization and promoting a security-centric culture throughout our business and operational functions. The CSO is at the forefront of enhancing our cybersecurity framework and strengthening the overall cybersecurity program. This involves upgrading tools and capabilities, which are part of a broader, multi-year strategy to continue to enhance security measures. The CSO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks and supports the Transformation and Chief Information & Digital Officer and the Company in managing such risks.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: We are in the process of implementing an enterprise-wide third-party risk management program that expands the review of vendors and includes financial and operational screening. This new solution is designed to help ensure compliance with the National Institute of Standards and Technology (NIST) supply chain risk framework that is required when supporting federal agencies.

companyName: MAXIMUS, INC.

ticker: MMS


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: UNITED RENTALS NORTH AMERICA INC


text: Cybersecurity threat risks have not materially affected the Company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect the Company, see "Item 1A. Risk Factors—Operating Risks— We rely on technology and information systems, many of which are controlled by third-party vendors, to maintain the security of our information and technology networks and to conduct our businesses, and any failures or interruptions of these systems could adversely affect our businesses and results of operations."

companyName: Apollo Global Management, Inc.

ticker: APO


text: Additionally, we have established processes to oversee and identify cybersecurity risks associated with third-party service providers. Thorough evaluations of their cybersecurity practices are conducted before engagement, ensuring our standards are met. Contractual agreements include requirements that enforce compliance with our security protocols, mitigating risks associated with third-party interactions.

companyName: Altus Power, Inc.


text: Amedisys has established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Enterprise Risk Management Committee ("ERMC") on a quarterly basis. In addition, our incident response plan includes processes to triage, assess severity, escalate, contain and investigate and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. These processes are assessed annually for effectiveness during our penetration testing.

companyName: AMEDISYS INC


text: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Executive Director – Corporate Product Cybersecurity and Functional Safety, who has more than 35 years of automotive industry and electronic controls design experience. The Executive Director – Corporate Product Cybersecurity and Functional Safety reports to our Chief Technical Officer. These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks. Through these updates, the SET Committee receives a report discussing product level vulnerability management, product level incident management and the status of relevant product cybersecurity activities.

companyName: CUMMINS INC

ticker: CMI


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Chadd Pence. With over 25 years of experience in the field of IT and cybersecurity, Mr. Pence brings a wealth of expertise to his role. His background includes experience as an enterprise CISO and his knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Chief Operating and Business Officer is responsible for implementing protection measures for our information systems from cybersecurity threats and promptly responding to any cybersecurity incidents.

companyName: ORAMED PHARMACEUTICALS INC.

ticker: ORMP


text: The Cybersecurity Committee, including the Company's Director of Technology, receive regular updates from the Company's management on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: Cohen & Co Inc.

ticker: COHN


text: The Company integrates cybersecurity into its overall approach to Enterprise Risk Management through a continuous evaluation of our environment for risks that could impact our overall posture. The Company's policies and procedures to address cybersecurity risks and threats are developed in conjunction with industry standards, best practices, and regulatory requirements. We ensure all employees and contractors are aware of cybersecurity risks through regular communication and required annual trainings.

companyName: WideOpenWest, Inc.

ticker: WOW


text: While we have not experienced any cybersecurity threats in the past in the normal course of business, in the future, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Management and Board of Directors' Role The Audit Committee meets regularly with management to help manage and assess risk exposures and potential damages related to information security, cybersecurity, and data protection and the steps management has taken to help identify, monitor, and control such exposures, as well as associated mitigation and remediation action, and actions to continue our operations. Information distributed to and discussed with the Audit Committee includes data on cybersecurity incidents and risks, company-wide enterprise risks, training programs, risk assessments, internal controls, security software, incident response plans, and forward-looking information security and business continuity strategies. The Audit Committee reports directly to the Board of Directors on a quarterly basis.

companyName: FTI CONSULTING, INC

ticker: FCN


text: As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. We are in the process of formalizing an incident response plan. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," of this Annual Report on Form 10-K.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: Related to Cybersecurity Risks Roivant's board of directors oversees our overall risk management strategy, including with respect to cybersecurity risks. Cybersecurity risk management policies and procedures are integrated into our overall risk management strategy, which is overseen by the audit committee of the board of directors ("Audit Committee"). At least annually, the Audit Committee discusses our risk management program, including any information security and technology risks and findings from any audits, with our Chief Accounting Officer and other members of our management team.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for the Company's enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: We use third-party service providers to perform a variety of functions throughout our business, such as cloud data hosting services. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers, which may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. The program includes contractually obligating certain third-party service providers with access to Information Systems and Data to implement and maintain cybersecurity practices consistent with applicable legal requirements.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Our Board of Directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: MEDICINOVA INC

ticker: MNOV


text: In assessing the effectiveness of its cybersecurity risk management program, the CISO makes use of external perspectives from regulatory compliance audits and inspections, external audits of the Registrants' financial systems, and third-party incident response and detection analytics. Cybersecurity risks associated with the Registrants' use of certain third-party service providers are evaluated and managed through CISS' Third Party Security team that leverages security risk assessments, contractual terms and conditions, and security awareness training for such providers. Additionally, those providers are required to report cybersecurity incidents, including the unauthorized use or disclosure of Registrants' confidential information to Exelon's security operations center. Third Party Security investigates certain third-party cybersecurity events as part of Exelon's incident response program.

companyName: EXELON CORP

ticker: EXC


text: Third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information;

companyName: Seneca Foods Corp

ticker: SENEA


text: We have established a continuous monitoring strategy and program, which includes: a set of defined security metrics to be monitored; performance of security control assessments on an ongoing basis; addressing results of analysis and reporting security status to the executive team; monitoring information systems to detect attacks and indicators of potential attacks;

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: We face risks from various security threats, including cybersecurity threats to gain unauthorized access to sensitive information or to render data or systems unusable or hold them for ransom. Cybersecurity attacks in particular develop and evolve rapidly, including from emerging technologies, such as advanced forms of artificial intelligence. Such attacks include, but are not limited to, malicious software, attempts to gain unauthorized access to data, ransomware attacks and other electronic security breaches that could lead to disruptions in critical systems, unauthorized release of or denial of access to confidential or otherwise protected information and corruption of data. We have experienced, and expect to continue to confront, efforts by hackers and other third parties to gain unauthorized access or deny access to, or otherwise disrupt, our information systems and networks. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect. See Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Our Operations - Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions" for more information regarding the risks we face.

companyName: Civeo Corp

ticker: CVEO


text: The Board oversees our cybersecurity risk management process, and the Audit Committee has the authority and power to provide specific oversight of cybersecurity matters. Our IT Director who has extensive experience in information systems and cybersecurity, leads our cybersecurity strategy, policy, standards, architecture, and processes. The IT Director reports to the Chief Financial Officer ("CFO"). The CFO provides regular updates to the Board, Audit Committee, and executive management on the status of our cybersecurity posture and any material threats.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: In particular, our information security program and approach are based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties. This program includes categorizing vendor risk based upon the types of service being provided and types of data handled, performing risk assessments using proforma questionnaires, and undertaking reviews of Systems and Organization Controls (SOC) reports for critical vendor relationships.

companyName: Argo Group International Holdings, Inc.


text: The CISO regularly attends Board Risk Committee meetings and sits in executive session with the Committee members at least annually to update committee members on material cybersecurity and other information security developments and risks. The CISO also provides an annual information security program summary report to the Board, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: Cyber criminals and malicious nation-state governments sponsored cyberthreat activity is becoming more sophisticated and effective every day, which we recognize includes increased targeting of the manufacturing sector and companies. All companies that utilize technology are subject to cyberthreat of breaches of their cybersecurity programs. To mitigate the threats to our Company, we take a comprehensive approach to cybersecurity risk management and technology infrastructure protections as a top priority.

companyName: PGT Innovations, Inc.


text: See our risk factors under Part I, Item 1A Risk Factors in this Form 10-K for additional information regarding cyber-security related risks that could materially affect our business strategy, results of operations, or financial condition.

companyName: biote Corp.

ticker: BTMD


text: Material Impact of Risks from Cybersecurity Threats As of the date of this report, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: As part of our enterprise risk management program, our Board and the Audit Committee of our Board (the "Audit Committee") oversee cybersecurity risk management and meet with our senior management team, which includes our Chief Executive Officer, President, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: We evaluate and update our cybersecurity risk profile through ongoing assessment of the cybersecurity threat landscape and security monitoring. Our cybersecurity risk profile is used as an input to identify, assess and update our Cybersecurity Program, and associated priorities are updated as new risk information becomes available. Information security, including cybersecurity, is also incorporated into our overall Enterprise Risk Management (ERM) program. Our ERM Operating Committee includes members in senior leadership positions across various functional areas that evaluate enterprise risks and develop and monitor associated mitigation plans. Cybersecurity related risks are included in the risk universe that the committee evaluates to assess top risks to the enterprise. As part of our ERM program, our executive leadership team receives annual updates on enterprise risks, including cybersecurity risks, as well as their potential impact, likelihood, potential mitigation plans and status.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are integrated into our overall risk management processes. Our strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.

companyName: NextPlat Corp

ticker: NXPL


text: management and strategy rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Ondas Inc.

ticker: ONDS


text: While Garrett focuses heavily on prevention and detection, response and recovery plans, service agreements and partner engagements are in place should there be a need for us to respond to a cybersecurity attack. The Company's response process includes identifying the incident; notifying the executive team, activating the crisis team, assessing the business risk and materiality of the incident; managing the recovery of operations; and performing a post-incident analysis. The Company maintains business continuity and disaster recovery plans. The Company also engages in cyber crisis response simulation to assess our incident response ability and effectiveness.

companyName: Garrett Motion Inc.

ticker: GTX


text: The WISP incorporates reviews by our Internal Audit department and external third-party experts. Periodic independent third-party maturity assessments are conducted against the NIST Cyber Security Framework. Investments in threat intelligence, collaboration with peers, vulnerability management, incident response drills, and participation in industry and government forums are also part of our program.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Our cybersecurity program is under the direction of our Chief Financial Officer ("CFO") and our Chief Technology Officer ("CTO"), who receive reports from our information technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO has over 26 years of extensive information technology experience in various roles of increasing importance. His experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst. Among his other duties as CTO, he manages our cybersecurity team, which comprises certified and experienced information security professionals, and he has been instrumental in the implementation and monitoring of our various cybersecurity systems and tools.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from the CIO on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: Board of Trustees Oversight The Board acknowledges the importance of managing risks associated with cybersecurity threats and cybersecurity incidents and has established oversight mechanisms to manage such risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of five independent Trustees, two of whom have considerable information technology experience.

companyName: CubeSmart

ticker: CUBE


text: Our incident response plan coordinates the activities that we and, as applicable, our third-party cybersecurity providers may take to prepare, respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Independence Contract Drilling, Inc.


text: We may engage third-party advisors to monitor threats and to scan for vulnerabilities. When a cybersecurity threat or incident is identified by our third-party advisor, it is reported directly to our VP of Tech. The VP of Tech in conjunction with professionals throughout the organization, including information technology specialists, accountants, and lawyers, determine severity and response, then manage it to conclusion in accordance with our cybersecurity incident response processes. We may engage third party advisors as part of our incident response processes to assist with digital forensics among other efforts. The VP of Tech, together with the cross-functional team, report material or potentially material incidents to our executive leadership and the Audit Committee. The VP of Tech provides further updates regarding root causes and remediation efforts. In the event the Company determines it has experienced a material cybersecurity incident the Board of Directors is notified.

companyName: AIR T INC

ticker: AIRT


text: We utilize advanced behavioral analysis tools to detect ransomware threats by identifying unusual encryption activity, unauthorized file modifications, and abnormal network communications.

companyName: Health In Tech, Inc.

ticker: HIT


text: >assessing audit reports issued on controls of certain outsourced, or externally-hosted, systems or applications; and >periodically evaluating our readiness by performing testing of our process and system for responding to cyber events, including our ability to recover following such events.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, processes, and practices, which are integrated into the Company's overall risk management process. To help protect the Company's information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: The Company's policies and practices are based on frameworks and standards that address risks through a comprehensive, cross-functional approach that assess, identify, monitor, and mitigate material risks from cybersecurity threats as part of the overall enterprise risk management ("ERM") process. This includes the collection and storage of data, and being responsive to incidents as they occur. Further, the Company's processes and technology are utilized to develop, implement, and maintain appropriate measures to safeguard information systems in protecting the integrity, availability, and confidentiality of data. Additionally, the Company engages certain third parties to assist in network monitoring and control testing, among other functions of similar capacity.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those used by our third party research institution collaborators, CROs, CMOs, or other contractors or consultants, may fail or suffer cyberattacks or security breaches."

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: The Company is exposed to diverse cybersecurity risks that have the potential to significantly impact our business operations, financial standing, and reputation. We seek to identify, assess, and manage these risks, with the aim of safeguarding our critical systems and information, and employ a documented process to respond in the event of a cybersecurity incident. This approach includes regular evaluations of our information systems and infrastructure to identify vulnerabilities and potential weaknesses through the use of system monitoring tools, as well as monitoring industry trends, threat intelligence, and emerging risks to anticipate and proactively assess potential threats. We engage third-party cybersecurity experts to conduct penetration testing, vulnerability scans, and risk assessments, informed by the NIST (National Institute of Standards and Technology) Cybersecurity Framework guidelines, to increase the likelihood that system risks are identified.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: Our Board of Directors is responsible for oversight of risks to the Company and is assisted by the Audit Committee in the oversight of cybersecurity risks. Management provides regular updates to the Board regarding the Company's key cybersecurity activities. In connection with its oversight, the Audit Committee monitors the quality and effectiveness of the Company's cybersecurity program, including security of its internal information technology systems and its products, services, and software solutions as well as our cybersecurity incident response plan and resources. Management provides quarterly updates to the Audit Committee about cybersecurity threat protection, detection, mitigation and remediation, including the overall status of the Company's cybersecurity program, results of third-party assessments, and recent cybersecurity threats. In addition, the Audit Committee reviews the Company's cybersecurity investment methodology to determine whether cybersecurity maturity improvements and risk reductions are being made.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Our cybersecurity program is overseen by a highly experienced team, including the Chief Information Officer (who reports directly to our Chief Executive Officer), our Senior Director of Information Technology, our Senior Director of Business Systems Applications and our Information Technology Security Manager. Collectively, this team has decades of expertise in information technology, and the Information Technology Security Manager holds a master's degree in Network Security. They meet regularly to discuss key cybersecurity risks and strategies, reporting to the Audit Committee annually or as necessary, in accordance with our cybersecurity incident protocols.

companyName: FIRST INDUSTRIAL LP


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A titled "Risks Related to Our Business Operations, Employee Matters and Managing Growth."

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The committee reports to the board regarding its activities, including those related to cybersecurity. The board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management as part of the board's continuing education on topics that impact public companies.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We recently created a new Technology and Innovation Committee of our Board to oversee jointly, alongside the Audit Committee, matters of technology, innovation, cybersecurity and information security. The Technology and Innovation Committee also provides advice and guidance to management on these matters. The Technology and Innovation Committee, Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Technology and Innovation Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. The Audit Committee oversees cybersecurity disclosures and receives periodic reports from management and the Technology and Innovation Committee. Further, the Technology and Innovation Committee and Audit Committee periodically discuss the Company's actions to identify and detect threats, as well as its cybersecurity strategic roadmap.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO, our Vice President – Cyber Risk Governance and our Senior Vice President – Enterprise Information Security. The management team is highly experienced in cybersecurity matters. The CISO has over 20 years of experience in cybersecurity including working at a global bank and leading cybersecurity vendors, and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Privacy Professional certifications for security and privacy, respectively. The CISO has a bachelor's, master's, and law degrees. The Vice President – Cyber Risk Governance has advanced degrees and certifications related to cybersecurity and over 15 years of experience with the federal government in a similar role. The Senior Vice President – Enterprise Information Security has more than 30 years of experience at the Company and held various information technology and information security risk management roles, including serving as a bank information security officer, and has a bachelor's degree and security certification.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Our incident response team maintains a standard playbook to respond to any potential cybersecurity incidents. We test and evaluate our plans on a regular basis.

companyName: PENTAIR plc

ticker: PNR


text: Ou r Chief Technology Officer oversees our security team, which is responsible for our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The security team consists of experienced engineers and analysts. All senior members of the team have industry recognized accreditations or commensurate experience. Our security team meets at least weekly and holds quarterly meetings with cross-functional leadership to report on cybersecurity risks and threats.

companyName: Ibotta, Inc.

ticker: IBTA


text: The ORIX USA CTO, leads the ORIX USA Information Technology and Cybersecurity Team responsible for managing information security at ORIX USA's asset management business, including its cybersecurity strategy and program, which encompasses annual employee training about cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA Information Technology and Cybersecurity Team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The ORIX USA CTO leads the cybersecurity team with over four years of experience at ORIX USA and 18 prior years of experience at a large asset management firm. This cybersecurity program is aligned with the NIST Cybersecurity Framework ("NIST CSF"), emphasizing training and development.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: In fiscal 2025, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, see "Risk Factors – Risks Related to our Business" in Item 1A. of this Form 10-K.

companyName: Worthington Steel, Inc.

ticker: WS


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A, "Risk Factors" in this Annual Report, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: Varex Imaging Corp

ticker: VREX


text: Third-Party Risk plan to implement and conduct security assessments of all third-party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Our board of directors are currently implementing as oversight procedure for IT governance and cyber security risk management. It is expected that IT governance and cybersecurity will be included in the company's quarterly management review meetings under the supervision of our senior leadership, including our Chief Executive Officer and Chief Financial Officer, with regularly meets with and provides periodic briefings to our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of our third-party vendors, collaborators, consultants or other third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to a material disruption of our product development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm and other adverse consequences."

companyName: Vor Biopharma Inc.

ticker: VOR


text: Bel employs a full-time Cybersecurity Expert who reports directly into our Global Head of IT and Cybersecurity Services. During 2024, the Company worked with third-party cybersecurity specialists to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third-party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: Using the policies and programs described above, Cass has implemented a multi-layered cybersecurity approach, including deployment of advanced endpoint protection, threat intelligence, and anomaly detection tools, continuous monitoring of network traffic through intrusion detection and prevention systems, regular penetration testing and vulnerability assessments, and encryption of sensitive data at rest and in transit.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. Further, the scope and impact of any future incident cannot be predicted. However, as of the date of this Form 10-K, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we face, please refer to the "Risk Factors" in Part I, Item 1A. of this Form 10-K.

companyName: HOLOGIC INC

ticker: HOLX


text: Specifically, our information security program, which is led by our Director, establishes and maintains our corporate-wide cybersecurity program and provides guidance and direction for information security activities and controls at Diodes. Through our cybersecurity program, we monitor the environment for incidents, classify the activity, and escalate incidents according to Company procedures. Incidents classified to a level that may significantly impact the Company are escalated to management for monitoring and action if necessary. The Company also maintains an appropriate system of hygiene for internal and external systems through accepted information technology practices such as patching, security monitoring, capacity management, availability monitoring, and third-party vulnerability scanning.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have dedicated resources and implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: INSEEGO CORP.

ticker: INSG


text: Our institution utilizes industry standard and regulatory approved assessment tools to identify cybersecurity risks and measure preparedness. The tools provide a repeatable and measurable framework for our organization to measure its cybersecurity preparedness over time.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Albemarle recognizes the importance of maintaining the security and integrity of our information systems and the data we collect, process, and store. We have implemented a comprehensive cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). As such, we map the CSF to corresponding legal, regulatory, and industry security practices, which guide our global policies and procedures to prevent, identify, protect, detect, respond, and recover from cybersecurity threats and incidents. Our cybersecurity program is managed by our Cybersecurity Director and is overseen by our Chief Information Officer ("CIO"), who assumes responsibility for the Chief Information Security Officer ("CISO") role. The cybersecurity program is integrated into our overall enterprise risk management framework and thus is factored into our long-term strategy and business continuity plans. Our Cybersecurity Director brings extensive experience in cybersecurity, including service in U.S. Army Cyber Operations, and has led initiatives in threat management, risk mitigation, and security architecture to strengthen enterprise resilience. His expertise in incident response and security strategy ensures our cybersecurity program remains aligned with industry best practices and evolving cyber threats.

companyName: ALBEMARLE CORP

ticker: ALB


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include discussions of current and emerging general material cybersecurity threat risks, including our particular cyber risk situation, and describing our ability and strategy to mitigate those risks and may discuss such matters with our Information Technology team or General Counsel. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: Cybersecurity is an important part of Vista's enterprise risk management processes and an area of focus for the Board of Directors and management for both Vista and us. These cybersecurity risk management and strategy processes are overseen by the Data Privacy and Information Risk Committee (the "DPIRC"). The DPIRC is co-chaired by the Vista CCO and Vista CIO, with members including senior representatives from Vista's Information Security, Legal, and Human Resources departments. The Vista CIO has extensive experience in cybersecurity and technology. The Vista CIO was appointed in 2017 and has over 20 years of cybersecurity, information security, and technology services and innovation experience.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.