text: The Company's management team, including the CTO, is responsible for assessing and managing the Company's material risks from cybersecurity threats. The CTO leads the technology management team and has extensive cybersecurity knowledge and expertise developed through a career of serving in various roles in information technology for over 20 years. The CTO oversees the Company's initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee. The CTO reports to the Chief Executive Officer ("CEO") and provides updates to the Company's senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues.

companyName: ESSEX PORTFOLIO LP


text: Governance, Risk, and Compliance includes the risk management and compliance management teams. This team manages the security awareness program, compliance with cyber and privacy regulations, security policies, and prioritizes potential cyber risks that require ongoing monitoring or remediation. Identified risks are brought to the Cyber Risk Steering Committee for treatment. The Chief Security Officer chairs the committee, which consists of the Deputy Chief Security Officer, cybersecurity managers, various subject matter experts, and (as needed) members of management from operational areas of the business.

companyName: NELNET INC

ticker: NNI

secItem: Item 1C


text: The Company's information security function and management team is led by our Vice President of Information Technology and Cybersecurity, who has approximately 38 years of experience in the information technology area and holds the CISM certification, and our Senior Director of Information Technology Infrastructure and Cybersecurity, who has approximately 25 years of experience in the information technology area and holds CISSP, CCSP, CISM, and OSCP certifications.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: We are committed to protecting our information technology ("IT") assets and data. This commitment includes the protection of IT assets relevant to our operations, employees, customers and suppliers' data, intellectual property and our products, among others.

companyName: Utz Brands, Inc.

ticker: UTZ


text: The Information Security team has adopted the NIST Cybersecurity Framework as a reference to manage cybersecurity risks. This framework enables the team to implement a comprehensive statement of activities and responsibilities that cover data, information architecture, risk communications, emerging technology, third-party risk, IT operations, and regulation. By following industry best practices, the team has established a recognized baseline for engaging external firms to audit and test the resiliency of the cybersecurity program. SONIC AUTOMOTIVE, INC.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: Our senior management and representatives from our business units regularly communicate with the Board of Directors on risk management matters, including cybersecurity risks. Senior management conducts regular risk assessments to identify risks that have the potential to significantly affect our business over the short-, medium- and longer term and reviews with the Board of Directors risk mitigation and oversight measures, including prioritization of risk management and allocation of responsibility within our company for the management of a particular risk.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Our Chief Information Security Officer leads our Cybersecurity Intelligence and Response Team ("CSIRT") whose function is to stay apprised of existing and emerging cyber threats and monitor our global enterprise and proactively identify and protect against cybersecurity risk. The CSIRT uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for, and address adversary activity against the Leidos network. The CSIRT possesses in-depth knowledge of network, endpoint, perimeter security systems, identity, data protection, threat intelligence, forensics, penetration testing and malware reverse engineering, as well as the functioning of specific applications or underlying information technology infrastructure.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, extended detection and response systems, identity and access controls, strong password controls, multi-factor authentication, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, vulnerability scanning, and performing external penetration testing. The Company has a process to report material results of such testing and assessments to the Board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to oversee and conduct part of such testing, as well as perform external audits of security protocols and capabilities. The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective by identifying critical vendors (defined based on capabilities provided and investments required) and reviewing software patching, upgrades and associated changes required to reduce risk. The Company also conducts cybersecurity training for employees, including mandatory training programs for system users. The Company's training programs require employees to complete a knowledge check prior to completion of the program. Completion of the Company's training programs is monitored by management.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: The Company's Executive Cybersecurity Oversight Governance Committee (ECOG), comprised of the Company's Chair and Chief Executive Officer (CEO), President, Executive Vice President (EVP) and Chief Financial Officer, and EVP, Chief Generation Officer and Enterprise Operational Excellence, receives monthly updates from the CAO and CSISO and provides senior management throughout the Company informational technology and operational technology perspectives, oversight and governance on investments and priorities for the broader cybersecurity organization, in addition to providing final decision oversight on recommendations and response to the ever-challenging cybersecurity threat landscape. The ECOG also is leveraged to supply information and bring transparency to senior management throughout the Company on the increasing threat landscape and the actions, response and road map to combat the threats.

companyName: PROGRESS ENERGY INC


text: We have a long-standing focus on cybersecurity risks and compliance with applicable safety protocols. Our primary cybersecurity focus areas are plant infrastructure, data privacy, and outsourced services. Within these areas, we maintain multi-faceted, layered security programs designed to protect and preserve the confidentiality, integrity and availability of data and systems. Within our organization, we have a mature information technology security program and cybersecurity responsibilities are clearly defined. We regularly invest in technology and information system upgrades designed to prevent, detect and respond to attacks. We also perform tabletop exercises for executive leadership.

companyName: OGLETHORPE POWER CORP


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external independent auditors. These assessments include a variety of activities including information security assessments, audits and independent reviews of our ISMS, control environment and operating effectiveness. For example, in 2023 and 2024, we conducted independent audits to assess our ISMS against the ISO/IEC 27001:2013 standard and received certification of compliance with the standard. We also undertake regular penetration testing of our systems. The results of significant assessments are reported to management and the Board. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.

companyName: authID Inc.

ticker: AUID


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: Information Security Policies and Procedures: We have established information security policies and procedures that govern the use, protection, and handling of sensitive information. These policies cover areas such as data encryption, access controls, password management, incident response, and employee training.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: We assess, identify and manage cybersecurity risks through various processes within our Enterprise Risk Management Program and Information Security Program. We focus on all areas of cybersecurity, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and continuity management. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of cybersecurity risk monitoring and risk mitigation techniques. Internal audits, external audits, and self-assessments are conducted to assess the effectiveness and maturity of our Enterprise Risk Management Program and Information Security Program.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; use findings and root cause analysis of cybersecurity incidents to improve our cybersecurity processes and technologies;

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: On an annual basis, the IT Director reviews the results of the current state of cybersecurity risk management, including the results of our cybersecurity risk assessment and any action plan to address any identified vulnerabilities.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards with regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response simulations. We also require cybersecurity training when onboarding new employees and contractors, as well as required cybersecurity awareness training for our employees and contractors/other workforce members. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Beyond Air, Inc.

ticker: XAIR


text: It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Keen Vision Acquisition Corp.

ticker: KVAC


text: Risk Assessment. At least annually, we conduct a cybersecurity risk assessment that takes into account information from our internal security, risk, and compliance functions, known information security vulnerabilities, and information from external sources, including reported security incidents that have affected other companies, industry trends, and evaluations by third parties and consultants. We also conduct risk-based cybersecurity tabletop exercises periodically to test our internal readiness and response planning.

companyName: Elastic N.V.

ticker: ESTC


text: We recognize the critical importance of maintaining the trust and confidence of our customers and employees. Consequently, we maintain a comprehensive security incident response plan ("SIRP") and we assess, identify, and manage material risks associated with cybersecurity threats. Our SIRP includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with an Information Security Committee comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors of the Company and the Bank receive training on an annual basis.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including cybersecurity consultants, to evaluate and support our risk management systems. We also rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, incident response, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday's business strategy. Additionally, the Board has delegated to our Audit Committee oversight of cybersecurity risks and processes to manage them. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.

companyName: Workday, Inc.

ticker: WDAY


text: The Chief Information Security Officer ("CISO") and the Chief Technology Officer ("CTO") are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CISO reports to the Risk Committee and is responsible for implementing and maintaining our enterprise cybersecurity organization. The CISO will maintain an Incident Response Plan. The CISO ensures that the Incident Response Plan is tested annually and will present testing results to the Risk Committee. The CISO and/or its delegate will share applicable threat information to ensure Board members and staff are informed on the evolving threat environment. The CISO is responsible for ensuring the Board of Directors and staff are trained annually on cybersecurity and information security awareness. Additionally, the CISO ensures staff is adequately trained on Incident Response Plan procedures. The CISO will ensure security incidents are logged and maintained. The CTO provides our Cybersecurity Program with the technical and functional resources to achieve its strategic goals and objectives, and partners and collaborates with the CISO.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: We apply an enterprise risk management ("ERM") methodology as established and led by our executive leadership team and overseen by our Board to identify, assess, and manage enterprise-level risks. Our cybersecurity risk program directly integrates and is intended to align with our governing ERM program.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Engagement – We review critical third-party systems at least annually, including the various System and Organizational Controls ("SOC") reports or perform risk assessments.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Voip-pal.com Inc

ticker: VPLM


text: Board of Directors is responsible for oversight of cybersecurity risk. Our Chief Financial Officer and Chief Executive Officer are the members of management responsible for managing and assessing our cybersecurity practices and have recently commenced reporting on such practices and risks. The plan for the future is that they will continue to report to the Board on cybersecurity at least quarterly. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: The Chief Information Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. As discussed above, our information systems are routinely reviewed for compliance with information security policies and standards. Outcomes of reviews and audits are reported to the Director of IT Security, Executive Vice President of IT and Information Security, and the Chief Information Officer. Relevant information about security nonconformities, incidents, and events are reported to the working group described below and to the Board of Directors. As discussed above, the Chief Information Officer and Executive Vice President of IT and Information Security report to the audit committee and the Board of Directors on cybersecurity matters at least quarterly.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from Finance, IT, Legal, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Cybersecurity Committee is also informed of our responses to such risks, incidents and threats.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: Annual network and penetration testing by reputable third parties to evaluate the Company's suite of security controls and tools and identify potential vulnerabilities. Regular cybersecurity and information security awareness training for associates, supplemented with recurring social engineering tests. Conducting regular cyber maturity assessments to ensure the Company is prepared to manage and respond to cybersecurity threats.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We have developed a framework designed to safeguard our organization's digital assets from threats and vulnerabilities. It involves a systematic approach of identifying, assessing, and mitigating risks associated with our technology systems, data, and operations. Key components of this include assessments of vulnerabilities, establishing security controls and policies, training employees, and having a well-defined incident response plan. Regular testing, compliance adherence, resource allocation, and continuous monitoring are also crucial to keeping our environment secure. We take a proactive approach, aiming to mitigate risk, protect sensitive information, and ensure the resilience of our digital infrastructure from cyber threats. We engage consultants or other third parties in conducting periodic assessments and testing of our policies, standards, processes, and practices.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.

companyName: INCOME OPPORTUNITY REALTY INVESTORS INC /TX/

ticker: IOR


text: The Company also has a business continuity/disaster recovery plan (the "BCP "), which it actively manages to prepare for any business continuity challenges it may face. Our BCP provides for the resiliency and recovery of our operations and services to our customers. The plan is supported and complemented by a robust business continuity governance framework, a life safety program as well as an enterprise-wide annual exercise and training to keep the program and strategies effective, scalable and understood by all employees. We believe both the Security Program and BCP adhere to industry best practices and are subject to periodic testing and independent audits.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: Our strategy for managing cyber-related risks is risk-based and, where appropriate, integrated within our comprehensive enterprise risk management processes. Liberty Global's Chief Security Officer (CSO), who reports directly to Liberty Global's Chief Technology Officer (CTO), leads a dedicated cybersecurity team and is responsible for the design, implementation and execution of our cyber-risk management strategy.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated incident response plan. Our incident response plan was developed to guide the internal response to incidents taking into account a recognized third party cybersecurity framework. Pursuant to our incident response plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the incident response team is made up of two teams: the information security response team and the business response team. The information security response team is generally led by our Chief Operating Officer and includes our CTO/CISO, our Director of Information Technology, our MS Provider account manager, our Chief Financial Officer and other members of our senior leadership. The business response team includes primary and secondary contacts for each impacted business area. These individuals assist with any necessary customer notification procedures. The incident response team regularly reports to senior management, including the CEO, in the event of a significant incident, and our Chief Operating Officer and Chief Financial Officer provide reports to our Audit and Cyber Risk Committee and our Board of Trustees.

companyName: LXP Industrial Trust

ticker: LXP


text: Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.

companyName: Eightco Holdings Inc.

ticker: ORBS


text: Protection of Customer and Other Sensitive Data – The Company complies with regulations for Customer Proprietary Network Information protection (Title 47 section 222) and has taken measures over the past several years to limit or remove Personal Identifiable Information ("PII") and other sensitive information from databases and internal systems. Access to sensitive information from third party partners is managed through secure virtual terminal environments, and movement of PII is monitored on premise and in key cloud applications.

companyName: CINCINNATI BELL INC


text: We have also established a Product Security Incident Response Team ("PSIRT") that identifies, assesses, and responds to security incidents, risks, and vulnerabilities associated with Qualys' commercial products. The Qualys PSIRT investigates vulnerabilities and incidents across the entire Qualys product portfolio. PSIRT coordinates product impact assessments and fixes based on industry standards such as the Common Vulnerabilities and Exposure ("CVE") and Common Vulnerability Scoring System ("CVSS"). PSIRT operates in alignment with relevant requirements and industry standards and coordinates its activities with the CSIRT.

companyName: QUALYS, INC.

ticker: QLYS


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and the Audit Committee on an ad hoc basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee and the Board of Directors Technology Committee. The ISO reports to the Senior Risk Officer.

companyName: Community West Bancshares

ticker: CWBC


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Amended and Restated Investment Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Our b oard of directors has established oversight mechanisms to manage risks from cybersecurity threats. The Audit Committee has responsibility for overseeing our cyber and information security program, which institutes and maintains controls for our systems, applications, and databases and for our third-party providers. The Audit Committee receives quarterly updates on the status of the cyber risk management program from the CTDO which include, among other things, a review of a dynamic and emerging cyber threat landscape, security events of note, updates on cyber risks and threats and the status of projects to strengthen and mature our cyber and information security program. Additionally, the SDCIS chairs the Cybersecurity Risk Committee, which seeks to drive awareness, ownership and alignment across broad governance and risk stakeholder groups for enhanced effectiveness of cybersecurity risk management and reporting. Members of senior management also discuss cybersecurity developments with the CTDO and SDCIS between meetings. Top identified cyber risks, metrics and measures of the effectiveness of the cyber risk management program are reviewed quarterly at the Cybersecurity Risk Committee and Company Risk Management Committee. Our Board also receives periodic updates from the CTDO and the SDCIS relating to cyber and information security risks.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: The Company, from time to time, experiences or is subject to a variety of incidents that arise during the ordinary course of its business. As of the date of this report and based upon the Company's experience, current information, and applicable laws, we do not believe that these incidents are material, or will have or have had a material adverse effect on business strategy, results of operations, or financial position. However, future cybersecurity incidents could materially affect our strategy, results of operations, or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the company.

companyName: MEDIFAST INC

ticker: MED


text: As of the fiscal year ending December 31, 2024, there have been no identified cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: INNODATA INC

ticker: INOD


text: Our CIO (who has 14 years of cybersecurity experience) and our Associate Director of Global Cybersecurity (who has 25 years of cybersecurity experience) are the members of our management team who are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO is a member of the Incident Response Team, and the Director of Global Cybersecurity is a member of our internal IT Security Team and the Incident Response Team.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " If we experience a significant disruption in our information technology systems, including our Platinum Analysis Software services, or cybersecurity incidents, our business could be adversely affected", which disclosures are incorporated by reference herein.

companyName: Quantum-Si Inc

ticker: QSI


text: Our ISSC, including the Chief Technology Officer, Chief Legal Officer, Chief Information Officer, and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The ISSC receives monthly reports and updates from the CISO on our cybersecurity risks and cybersecurity incidents. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISSC includes team members who have previously completed ISO 27001 certification for international companies as well as individuals with professional cybersecurity relevant certifications such as CISSP and CCISO.

companyName: TechnipFMC plc

ticker: FTI


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: PROSPER MARKETPLACE, INC


text: We have implemented various security measures to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: The company's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally and report cybersecurity incidents to appropriate levels of management based on potential impact. The company conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, IT management exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The company takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: The Company maintains a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program is integrated within the Company's enterprise risk management framework and addresses both the corporate information technology environment and the external ecosystem.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. The Company maintains cybersecurity insurance as part of its overall insurance programs.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see "Item 1A. Risk Factors—Operational Risks."

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section entitled "Risks Related to Employee Matters, Managing Growth and Macroeconomic Conditions."

companyName: Kura Oncology, Inc.

ticker: KURA


text: The Company's Board of Directors, through the Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from information systems and cyber security threats. The Risk Committee periodically receives presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party reviews, technological trends, and other cybersecurity related topics. The Risk Committee also receives information regarding any material cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been addressed. On a quarterly basis, the Risk Committee and the Board of Directors receive updates on key risk and key performance metrics related to the Company's information systems and cyber security posture with the Risk Committee receiving additional information regarding noncompliance with risk limits and associated remediation efforts. On at least an annual basis, the full Board of Directors discusses the Company's approach to information systems and cyber security risk management with the CISO.

companyName: LAKELAND BANCORP INC


text: Our efforts are led by ACV's Chief Information Officer ("CIO") with the oversight of our Audit Committee, Chief Legal Officer and Chief Financial Officer, who oversees a team of cybersecurity professionals (the "Cybersecurity Department") dedicated to identifying, assessing, escalating, responding to, and recovering from cybersecurity threats on a day-to-day basis.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Our senior management team, led by our Chief Financial Officer and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;

companyName: BTCS Inc.

ticker: BTCS


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats. At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receives an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services. These sessions typically cover topics such as data security posture, results from third-party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, internal controls over financial reporting and business continuity planning.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: We maintain a comprehensive, risk-based, third-party risk management process to identify, assess and manage cybersecurity risks associated with third-party service providers. Third-party service providers undergo thorough pre-engagement due diligence, including security and privacy assessments. All contracts with such third-party service providers are required to contain security and data processing terms no less stringent than those employed by us in safeguarding our own data. Any third-party service providers with access to confidential or sensitive data are subject to ongoing oversight activities, including assessments and audits, throughout the lifetime of the engagement.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk assessment and identified in the Company's risk register.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Cybersecurity Leader. Our Cybersecurity Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.

companyName: Nextpower Inc.

ticker: NXT


text: TIAA's management team periodically reports to the Fund's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Fund, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.

companyName: Nuveen Churchill Private Capital Income Fund


text: Our Internal Cybersecurity Team is comprised of the Chief Information Officer, Senior Director of Technical Operations & Security, and Information Security Manager. This team is responsible for managing efforts to assess, detect, prevent, mitigate and remediate cybersecurity risks, threats and incidents. This team has combined experience of 70 years in Information Technology, with over 35 years in managing cybersecurity programs, and hold various cybersecurity certifications. In addition, this team meets monthly with the IT leadership team to review current risks and trends, along with monitoring ongoing cybersecurity metrics.

companyName: CARROLS RESTAURANT GROUP, INC.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data"). Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework. Cybersecurity risks are assessed and managed alongside other material risks, including financial, operational, legal, and strategic risks, to ensure a comprehensive approach to risk oversight.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents and recommend mitigating actions. Despite our best efforts, no security measure is entirely foolproof. In the event of a cybersecurity incident, we utilize a range of standard incident response practices that identify, analyze, contain, and recover the event with the goal of minimizing the impact and restoring normal operations. In the event of a cybersecurity incident, we have standard incident response practices that contain, analyze, and recover with the goal of minimizing the impact and restoring normal operations after each event. Employees receive periodic cybersecurity trainings including phishing campaigns and general awareness campaigns.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: The CISO, under the guidance of our CIO, CRO, Chief Executive Officer and General Counsel, works collaboratively across the Corporation to implement an information security program. To facilitate the success of the Corporation's cybersecurity risk management program, multidisciplinary teams throughout the Corporation are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the 2nd Line Information Security Risk Management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the ERC when appropriate.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: The Audit Committee, designated as the responsible body for risk management and compliance oversight, endeavors to ensures information flow of risk by regularly reporting its activities to the Board, including those related to cybersecurity. Our cybersecurity program is led by our Chief Information Security Officer (CISO), who has over 20 years of experience in the cybersecurity field, and who is primarily responsible for assessing and managing material risks from cybersecurity threats. Their expertise is supported by industry certifications, regular participation in leading advanced training programs, and advisement roles. The CISO leads a dedicated team of security professionals who provide coverage of critical program capabilities. Our CISO and larger cybersecurity risk management team take steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: As part of our overall risk management system, we monitor our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings integrated into new employee onboarding processes and annual employee re-training.

companyName: Cyclo Therapeutics, Inc.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the Director of Information Technology, COO, CRO, and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements.

companyName: BayCom Corp

ticker: BCML


text: Risk assessments: Our security team, in coordination with our enterprise risk management team, conducts periodic risk assessments to identify and analyze the business and security risks, vulnerabilities, emerging technologies, laws and regulations. Our internal audit team evaluates the results of these risk assessments to determine critical areas for audit as part of our annual internal audit plan. The results of the internal audits are reported to the audit committee, and the security team manages and maintains remediation strategies for identified risks.

companyName: HUBSPOT INC

ticker: HUBS


text: The processes implemented by our IT leadership and IRT to oversee and identify cybersecurity risks are based on the Prologis Information Security Policy governed by the United States National Institute of Standards and Technology Cybersecurity Framework. The framework focuses on five key categories of cybersecurity risk management and governance: (i) identify: develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (ii) protect: develop and implement appropriate safeguards to ensure delivery of critical services; (iii) detect: develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) respond: develop and implement appropriate activities to take actions regarding a detected cybersecurity incident; and (v) recover: develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or service that were impaired due to a cybersecurity incident. This framework is utilized within our organization as part of an integrated risk management program that involves participation from employees, to our Board and third-party service providers, with whom we have protocols in place to mitigate cybersecurity incident risks within our supply chain through the products and services we provide and use. Additionally, all employees and contractors are required to attend mandatory cybersecurity training on an annual basis.

companyName: Prologis, Inc.

ticker: PLD


text: We have adopted comprehensive Information Security Policies and Standards that clearly articulate Parker's expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification. These policies and standards set forth a detailed security incident management and reporting protocol, with clear escalation timelines and responsibilities. We also maintain a global incident response plan and regularly conduct exercises to help with our overall preparedness.

companyName: Parker-Hannifin Corp

ticker: PH


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, managed cybersecurity providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. Board members, including members of the Audit Committee, have expertise and/or operational experience in cybersecurity matters. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: The Security, Compliance and Data Protection team is led by the CISO who has 25 years in business risk management and cybersecurity and reports to the Chief Information Officer (CIO) who has over 25 years in information technology and security roles. The Security, Compliance and Data Protection team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of our information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. Incident Response and Management teams utilize procedures that identify escalation paths when security events are identified. Incident priorities dictate escalation of events and how they are reported up from an Incident Commander up to the executive leadership team within Wiley as well as to the Board.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Enterprise-wide information security training (including with respect to cybersecurity), supplemented by awareness programs, is crucial for risk reduction and safeguarding customer, employee, and company information. We provide training to employees and certain third-party contractors based on access to our network, risk, roles, policies, standards, and behaviors, which is updated to address emerging technology and security issues.

companyName: FEDEX CORP

ticker: FDX


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and contract research organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment for certain vendors.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Our Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Tracon Pharmaceuticals, Inc.


text: We conduct continuous assessments of our cybersecurity standards, perform regular tests of our ability to respond and recover, and monitor for potential threats. To further mitigate threats, we collaborate with governments and regulatory agencies, and take part in external events to learn and share. Our workforce participates in regular security awareness training, including exercises to build capabilities to identify and report suspect phishing emails to our SOC. In the last year, we continued to expand the cybersecurity training and simulated testing we administer to high-risk groups within the organization. A tailored cybersecurity training course has been implemented for team members in operational technology roles, and we have increased the frequency of phishing simulation tests.

companyName: ENBRIDGE INC

ticker: ENB


text: Our board of directors reviews our management of cybersecurity risks, and our Audit Committee has been delegated primary oversight of such risks and the steps our management has taken and takes to monitor and control these exposures. Our data privacy and security program is overseen by our Vice President of IT, who presents to the Board on an annual basis. Starting in 2024, our Board receives quarterly briefings on cybersecurity matters and the Company's efforts to prevent, detect, mitigate, and remediate cybersecurity risks. Our Audit Committee also receives regular briefings on cybersecurity matters, including cybersecurity threats and receives details on any significant cybersecurity incidents.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: Our CISO and Vice President, Enterprise Risk, Compliance and Service Management report to our Chief Digital Officer, who in turn reports to our President and Chief Operating Officer. These officers drive our cybersecurity priorities at the executive level.

companyName: Dayforce, Inc.

ticker: DAY


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents of a material nature. For additional information about the risks from cybersecurity threats, see "Item 1A. Risk Factors" in this Annual Report.

companyName: LendingClub Corp

ticker: LC


text: We and Deutsche Bank Group operate in an environment with increasing levels of digitization and a continually evolving landscape related to cybersecurity threats. Due to the dynamics and complexity of the current environment, the Deutsche Bank Group is continuously monitoring the security threat landscape. Deutsche Bank Group vigilantly observes technological developments, the geopolitical landscape and economic impacts driving security risks and assesses their relevance for potential impacts to Deutsche Bank Group and the wider financial ecosystem.

companyName: RREEF Property Trust, Inc.


text: Incident Response, Recovery Planning and Disclosure Our Bank is subject to the Interagency Guidelines, as noted above, and our Company is subject to the SEC's Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies adopted in July 2023. In accordance with these rules and regulations, we have sought to establish comprehensive incident response and recovery plans, and we continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our planned response to a cybersecurity incident. With respect to the potential disclosure of material cybersecurity incidents, we have designated our management Financial Review and Disclosure Committee as the proper forum to address such issues. Members of Financial Review and Disclosure Committee include the Chief Financial Officer ("CFO"), General Counsel, Chief Operating Officer ("COO"), Chief Risk Officer ("CRO"), and the Chief Information Security Officer ("CISO").

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: In addition, our Executive Incident Management Team ("EIMT") is a cross-functional management committee dedicated to providing executive-level guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.

companyName: ROKU, INC

ticker: ROKU


text: The Company has developed and implemented a comprehensive cybersecurity risk management program that is intended to protect the secure processing, transmission and storage of confidential information in its computer systems and networks. The Company's cybersecurity risk management program, a component of the Company's Enterprise Risk Management ("ERM") Program, is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. The Company's process for identifying, assessing, managing and prioritizing cybersecurity risks throughout the Company includes: • A third party risk assessment program for the Company's third party vendors that access the Company's data (each, a "Vendor") to ensure that all Vendors meet the Company's cybersecurity requirements, including, periodic risk assessments of Vendors, monitoring Vendor compliance with the Company's cybersecurity requirements, and a requirement that all contracts with Vendors include provisions requiring the Vendor to notify the Company of any cyber incident, and/or to maintain minimum levels of cybersecurity insurance; • A security awareness program that includes training employees on best practices for securing the Company's data, as well as regular social engineering testing to keep employees informed of cybersecurity threats and to train them to look for malicious emails and other potential cybersecurity threats; • A dedicated information security team that monitors threats and vulnerabilities that arise, and regularly performs threat intelligence and vulnerability management; • The Company's engagement of a third party to conduct periodic independent testing of the Company's cybersecurity defenses to confirm that the defenses are effective; • A Managed Detection and Response ("MDR") service that continuously monitors the Company's systems and alerts the Company's information security team of any detected anomalies or suspicious activity and stops any event that is deemed dangerous to the Company's systems or networks; • An Incident Response Plan ("IRP") and Business Continuity Plan ("BCP") which outline steps to be taken during a cyber incident and to recover systems and continue business operations following a cyber incident; and • A Cybersecurity Incident Response Team ("CSIRT") that tracks cyber incidents, including those that affect third parties that are handling the Company's data.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: NIST SP 800-34, Rev 1, "Contingency Planning Guide for Federal Information Systems," November 2010 NIST SP 800-37 Rev. 2, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," December 2018 IST SP 800-53, Rev. 5, "Security and Privacy Controls for Information Systems and Organizations," September 20, 2020, updated December 10, 2020 NIST SP 800-61, Rev 2, "Computer Security Incident Handling Guide," August 2012 Our approach to cybersecurity aims to protect the confidentiality, integrity, and availability of the data we handle. This process involves measures to identify and prevent cybersecurity threats and mechanisms to mitigate and respond to cybersecurity incidents.

companyName: WIDEPOINT CORP

ticker: WYY


text: While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Currently we are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have a material effect. However, cyber-attacks are increasing in frequency, sophistication and intensity, and despite our ongoing efforts we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: The Committee receives regular reports from management on the cybersecurity risks that we evaluate and which we may face in the future. In addition, management updates the Committee as necessary regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: System1, Inc.

ticker: SST


text: The Board maintains responsibility for oversight of risks that may affect the Company. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee reviews the Company's policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks. Certain members of our Audit Committee have experience with respect to cybersecurity risk management.

companyName: ESAB Corp

ticker: ESAB


text: The Board and IT Committees oversee the responsibility in developing, implementing, and maintaining the information security program and cybersecurity program, and hold senior management accountable for its actions. To accomplish this, the Board maintains a reasonable understanding, and is informed through Committee minutes and Board meetings. The Board of Directors receives annual training on cybersecurity and information security.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Their CISO reports to their CIO who is responsible for their and our technology, data and information management strategy, and brings over two decades of relevant experience to the role.

companyName: JLL Income Property Trust, Inc.


text: Our systems are being threatened by cybersecurity incidents on a regular basis and our efforts may be insufficient to prevent or defend against incidents or an attack. We, and certain of our third-party vendors, have experienced attacks and incidents in the past, and there can be no assurance that we, or any vendor, will be successful in preventing future attacks or incidents or detecting and stopping them once they have begun. Through the date hereof, risks from cybersecurity threats, including prior incidents and attacks, have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity risks evolve rapidly and are complex, so we must continually adapt and enhance our processes and defenses. As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging processes, and we can provide no assurance that processes and defenses that we implement will be effective. See Item 1A, Risk Factors – III. Operating Risks above for more information.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: We, along with our external partners, use resources, technology, and processes to identify, remediate, and report security threats in our systems. These controls are crucial to minimize our attack surface and prioritize possible threats.

companyName: PVH CORP. /DE/

ticker: PVH


text: We recognize the critical importance of maintaining the trust and confidence of customers, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: G1 Therapeutics, Inc.


text: Technical Safeguards: The Company deploys commensurate technical safeguards, including firewalls, encryption, network segmentation, real-time monitoring, intrusion prevention systems, anti-malware, and access controls.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: Our management team, including specifically our Chief Financial Officer, working closely with our Vice President of Information Technology and our Director of Cybersecurity (our Cybersecurity Oversight Team), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Oversight Team's experience includes a combined 50+ years in the pharmaceutical industry and information technology. This includes software and systems development, cybersecurity program oversight, and overall IT management. The team has over two decades of experience dedicated to supporting enterprise architecture and more than eight years of experience specializing in cybersecurity, implementing cybersecurity frameworks, assessing and managing cybersecurity risks, and executing incident response plans.

companyName: Nuvalent, Inc.

ticker: NUVL


text: We have a cybersecurity risk management process intended to protect the confidentiality, integrity and availability of our critical systems and information. We design and assess our process based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: KLA CORP

ticker: KLAC


text: In the event of a reported potential cybersecurity incident, the Global Information Security team ("GIS") determines whether such incident triggers our cybersecurity threat evaluation and response plan (the "Response Plan"). If triggered, our cybersecurity response team, which includes representatives from GIS, our business team, and executive leadership, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team are responsible for developing, recommending and implementing the necessary measures to address the cybersecurity incident, including assessing, containing and mitigating its impact, notifying members of our management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The Cyber Response Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Risk Management and Governance Cybersecurity is a material part of Unity Bank's business. As a technology forward financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors – The Company cannot predict how changes in technology will impact its business"; as increased use of technology may expose us to service interruptions or breaches in security.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company has established certain controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company's Incident Response Plan: (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures; and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.

companyName: Janus International Group, Inc.

ticker: JBI


text: We have processes and programs in place to meet our global compliance obligations and work with our employees and teams across the globe to ensure security and data protection principles are integrated into the way we do business every day. We utilize a set of controls that integrate guidance from the EU's General Data Protection Regulations and align with the U.S. National Institute of Standards and Technology's ("NIST") framework. We undergo a regular independent assessment of our operational and strategic maturity across NIST controls and summary performance is shared with senior leadership including our board of directors. In addition, we submit to independent assessments by external parties, including System and Organizational Controls ("SOC") 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should. These functions are also supported by internal compliance teams that perform additional layers of testing prior to SOC 2 Type 2 procedures.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), AGM's CISO, other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by AGM's CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. AGM's CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.

companyName: Apollo Realty Income Solutions, Inc.


text: Role of the Board Our Board is ultimately responsible for the risk oversight of the Company, including risks from cybersecurity threats. The Board has delegated to the Audit Committee responsibility for monitoring the overall adequacy and effectiveness of the ERM Program, and the Audit Committee is specifically charged with discussing the Company's cybersecurity risk exposures and the steps management has taken to monitor and control these exposures. The Board and/or the Audit Committee receives periodic reports, briefings and presentations on data protection and cybersecurity matters from senior information technology leaders, including our Chief Digital and Information Officer ("CDIO") and CISO, as well as from our Internal Audit team. In addition, our Chief Legal Officer provides reports on the ERM Program. Periodically, our Board receives reports and/or presentations on cybersecurity matters prepared by third-party cybersecurity experts. In addition to these Board and Audit Committee updates, our CIRP provides that significant developments or incidents, even if immaterial to the Company, will be reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee or Board is appropriate, enabling Audit Committee and Board oversight that is timely and responsive.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: The Company maintains a cyber risk management program to prevent, detect and respond to information security threats. This program is supervised by a dedicated Chief Information Security Officer (CISO) whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CISO manages the program in collaboration with the Company's businesses and functions. To mitigate the risk of cybersecurity threats and data breaches we also have established policies and procedures, including a Cybersecurity & Data Breach Incident Response Policy and identified an Incident Response Team (IRT) with defined roles, responsibilities and means of communication. As part of our broader risk management and control framework we have implemented cybersecurity controls over the information technology and process control systems of the Company and of its third-party service providers. The Company engages third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer and vendor data as well as data affecting our process controls and data used to operate our manufacturing and converting facilities. We work with an independent assessor to conduct interim assessments and track ongoing efforts to continuously improve the Company's cyber risk management program. The most recent assessment was completed at the end of 2022. In addition, the Company utilizes an independent audit firm to perform specific attack and penetration reviews on an annual basis. While we have experienced threats to our data and systems, as of December 31, 2024, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: We have an Enterprise Risk Council made up of leaders from our principal functional areas and business units that meets on a quarterly basis to update our enterprise risk framework used to identify and manage our key risks, including cybersecurity. Cybersecurity is a standing item on our Enterprise Risk Council agenda and our cybersecurity team regularly presents its work to the Enterprise Risk Council to enable evolving risks to be integrated into our management processes. The Global Information Security team, led by our CISO, create cybersecurity processes and frameworks for use throughout IQVIA. Our CISO is an experienced cybersecurity leader with over 25 years of experience in security, technology and risk management, and has previously served as a public company CISO for a global financial services firm, where he spent 18 years serving in roles of increasing responsibility, leading large cross functional security and technology teams.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees and violation of data privacy or security laws.

companyName: Telomir Pharmaceuticals, Inc.

ticker: TELO


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, cloud-based infrastructure, encryption and other functions. We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, and the sensitivity and quantity of information processed, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Given the constantly evolving cyber-threat landscape, as well as the previously disclosed ransomware attacks we experienced in 2019 and 2020, we continuously test and evolve our cybersecurity program. We engage internal security team experts who perform 'ethical hacks' against our information assets to uncover risks. As part of its risk based annual audit plan, our internal audit team reviews a number of components of our information technology operations, which taken together, comprise our cybersecurity defenses. A report of its findings is distributed to certain members of management and completion of the auditor's comments is tracked and reported up to the Audit Committee. We also engage third party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Cybersecurity Risks As of December 30, 2023, we have not had any material incidences involving cybersecurity attacks. However, we face risks associated with cybersecurity threats. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a cybersecurity incident or disruption as described above, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "Risk Factors–Risks Related to Our Client Relationships–Information, technology systems or service failures, or a cybersecurity attack or other compromise of our or our client's confidential or proprietary information, could have a material adverse effect on our reputation, business and results of operations."

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: Material Cybersecurity Risks, Threats & Incidents We are not aware of any cyber event that has had a material effect on our business. However, we cannot ensure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. In addition, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, results of operations and financial condition. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our cybersecurity systems, controls and processes are overseen by our cybersecurity information technology team which is managed by our CISO. Our CISO has over 25 years of experience in the information technology and cybersecurity field and is a Certified Information Systems Security Professional.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company also relies on the cybersecurity policies and procedures implemented by Varagon and its affiliates. Varagon has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to Varagon's Information Security (Safeguards) Policy (the "Information Security Policy"), the Chief Financial Officer of Varagon serves as the Information Security Policy Coordinator and is responsible for the ongoing and regular monitoring of the Information Security Policy to ensure that it is operating in a manner reasonably calculated to prevent unauthorized access to, or unauthorized use of, non-public information. Varagon has engaged and may engage, from time to time, assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks, subject to the continued oversight of Varagon.

companyName: Varagon Capital Corp


text: Nordson Corporation 18 The CISO assesses cybersecurity readiness using a variety of tools, including internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. Our security and compliance organization elevates issues relating to cybersecurity to our Chief Executive Officer and Board of Directors, such as potential threats or vulnerabilities. We also seek to prevent, detect, mitigate and remediate cybersecurity incidents by employing various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: NORDSON CORP

ticker: NDSN


text: Use of Third Parties We work with a third party that provides us with threat hunting services via an Endpoint Detection and Response (EDR) platform. This team proactively searches for newly uncovered threats based on up-to-the-minute intelligence on the cybersecurity threat landscape and their knowledge of the Zumiez environment. Upon discovery of a potential threat, the threat hunting team provides initial remediation guidance.

companyName: Zumiez Inc

ticker: ZUMZ


text: Third Party Security Monitoring Leveraging an industry recognized expert in cybersecurity monitoring, we have incorporated cybersecurity monitoring to increase visibility, awareness and responsiveness to cyber threat actors. Our monitoring partner is able to quickly analyze and alert us to suspicious activity, as well as take part in any active cyber investigation when necessary. The monitoring expertise provided allows us to focus on other aspects of cybersecurity while simultaneously ensuring that we are prepared to detect and respond appropriately to security incidents.

companyName: Loar Holdings Inc.

ticker: LOAR


text: We have designated our Chief Information Officer who reports to our Chief Executive Officer and Chairman of the Board to manage the assessment and response to material risks from cybersecurity threats. Our Chief Information Officer's cybersecurity expertise includes over 18 years of experience in information security and technology.

companyName: TETRA TECH INC

ticker: TTEK


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take annual cybersecurity training and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of the cybersecurity training. We also periodically conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments led by Internal Audit to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Two-factor authentication for email (Office 365) and cloud-stored information We protect our mail system against spam, phishing, spoofing, and malware using a (Mail Relay system). Additionally, we enforce a real-time threat notification mechanism and activate alerts and reports for failures in our backup system.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: Management is responsible for identifying and assessing material cybersecurity risks on an ongoing basis and for developing, managing and implementing our cybersecurity program to assure that our potential cybersecurity risk exposures are monitored and appropriate mitigation measures are implemented. Our cybersecurity program is overseen by our Vice President, Information Technology and our Director, Cybersecurity. Our Vice President, Information Technology has significant professional experience in leading the information technology function and our Director, Cybersecurity has held various roles in cybersecurity and is an ISC2 Certified Information Security Professional (CISSP). Each periodically participates in various industry cyber forums and communicates industry best practices to the appropriate internal information security professionals.

companyName: MASCO CORP /DE/

ticker: MAS


text: Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact us or our operations. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. See Item 1A. Risk Factors "A failure in our information technology systems or those of third parties, including those caused by security breaches, cyber-attacks or data protection failures, could disrupt our business, result in significant legal costs and other losses and damage our reputation" for a discussion of cybersecurity-related risks.

companyName: DMC Global Inc.

ticker: BOOM


text: Management Oversight. While the Board of Directors and its Audit and Technology Committees oversee management's processes related to cybersecurity risks, management is responsible for identifying, monitoring and mitigating the material cybersecurity risks that face the Company. The Company's CRO is directly responsible for the overall cybersecurity risk management program which is a part of the Company's ERM Program. The CRO and the DIS oversee the information security department's implementation and maintenance of the cybersecurity risk management program, including oversight of Vendors and regular reporting to the Board of Directors and its Audit and Technology Committees on the effectiveness of the cybersecurity risk management program. The DIS updates the CRO as appropriate, including as new developments or information related to cyber incidents arise.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: For the fiscal year ended February 29, 2024, there have been no known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: VOXX International Corp


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personal data, including of our employees, consultants and clinical trial participants (Information Systems and Data).

companyName: Vera Therapeutics, Inc.

ticker: VERA