text: Our information security program, the framework for how we assess, identify and manage risks from information security and cybersecurity threats, is designed in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverages the International Organization for Standardization 27001 framework. Cybersecurity risk is integrated into our overall strategic risk management ("SRM") program, which evaluates key risk areas across Paramount by a cross-functional group of risk owners, in close coordination with members of senior management.

companyName: Paramount Global


text: Our Audit Committee of the Board of Directors is responsible for oversight of risks from cybersecurity threats. Our Audit Committee receives quarterly reports from our Enterprise Risk Management Committee ("ERM Committee"), as well as directly from our Chief Information Officer ("CIO") or VP Infrastructure, periodically, as appropriate. These reports cover various cybersecurity matters, including risk assessments, risk prevention and mitigation activities, and incident reports along with remediating actions, areas of emerging risks, industry trends, and other areas of importance. Furthermore, our Audit Committee oversees our annual enterprise risk assessment. This assessment encompasses key risks associated with security, technology, and cybersecurity threats in the same manner as other key risks.

companyName: MARZETTI CO

ticker: MZTI

secItem: Item 1C


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a comprehensive approach to overseeing and managing cybersecurity and related risks. Our Board of Directors (the "Board"), the Audit Committee of the Board (the "Audit Committee"), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. A key component of this is our standing Security Steering Group ("SSG"), whose members include, among others, our Chief Information Security Officer ("CISO"), Chief Product Officer, and Vice President of Cloud Technology. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and practices will be properly followed in every instance or that they will be effective.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Prelude has established an Information Security Policy ("IS Policy") in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of Prelude's information and its assets. The IS Policy was prepared using relevant guidance issued and technology standards that are used across various industries. The IS policy applies to all entities who are using Prelude's equipment and resources, including but not limited to: employees, contractors, temporary workers, any third parties with access to the Prelude's resources, and cloud IT providers. Prelude's Head of Information Technology ("IT") also serves as our Information Security Officer and is primarily responsible for implementing and overseeing the IS Policy and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: Nuvalent, Inc.

ticker: NUVL


text: The Board of Directors is actively involved in oversight of the Company's risk management framework. The Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity awareness. This integration ensures cybersecurity considerations are an integral part of decision-making processes across the organization.

companyName: Energy Services of America CORP

ticker: ESOA


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations, or financial condition during the financial years ended December 31, 2024 and December 31, 2023.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: The CISO reports to the CIO and is principally responsible for overseeing the Program, in partnership with other business leaders across the Company including regional information security and technology officers. The Company's cybersecurity personnel maintain current knowledge through specific training programs, professional certifications, and participation in industry groups (e.g., Financial Services Sector Coordinating Council, Financial Services Information Sharing and Analysis Center, Analysis and Resilience Center, Securities Industry and Financial Markets Association, Cybersecurity and Infrastructure Security Agency, etc.). Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and quarterly sponsored simulated exercises to practice their response to real-life threats. In addition, personnel are encouraged to obtain industry approved certifications as appropriate for their roles and responsibilities. Below are some examples of certifications held by the Company's cybersecurity personnel: Certified in the Governance of Enterprise IT, Certified Information Systems Security Professional, Certified Information Security Manager, Certified Risk Information Systems Control, Global Information Assurance Certification (GIAC) Certified Incident Handler, GIAC Assessing and Auditing Wireless Networks, and GIAC Continuous Monitoring Certification.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: During the year ended December 31, 2023, the Company is not aware of any cybersecurity incidents or threats that materially affected our business, results of operations or financial condition.

companyName: New Fortress Energy Inc.

ticker: NFE


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect MetLife, including its business strategy, results of operations or financial condition. For further discussion of MetLife's risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality and Integrity of Our Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."

companyName: METLIFE INC

ticker: MET


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Bank's Information Technology Steering Committee as well as the board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of Peapack-Gladstone Bank's organization and is evaluated at least annually.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our Senior VP of Global IT and System Operations, IT Security Officer and the information security team, in conjunction with our legal team and third-party service providers, help identify, assess and manage our cybersecurity threats and risks. Our Senior VP of Global IT and System Operations, IT Security Officer and the information security team identify and assess risks from cybersecurity threats by continuously monitoring and evaluating our threat environment using various methods, including, for example: conducting vulnerability assessments to identify vulnerabilities, conducting scans of corporate devices and network infrastructure, analyzing reports of potential, known and identified threats and actors, using automated and manual tools to monitor for, identify, or evaluate threats and risks, conducting audits and threat assessments, and utilize third party managed detection and response (MDR) 24/7/365 cybersecurity vendor services that help identify cybersecurity threats, using third party threat assessments and external intelligence feeds, and evaluating our company's and our industry's risk profile.

companyName: ENZO BIOCHEM INC


text: Our Chief Information Officer ("CIO"), CISO and other members of management provide quarterly updates to the Audit Committee and meet with the Board of Directors at least annually regarding risks related to information systems, information security and cybersecurity. Specific topics may include updates to the Company's strategy to combat cybersecurity risks; cybersecurity news and events; key focus areas; the threat landscape; and the results of certain assessments and testing. Our CIO, CISO or other members of management provide information to the Audit Committee or our Board of Directors, as applicable, pursuant to risk-based escalation protocols for cybersecurity incidents in accordance with an established materiality framework.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: ARVINAS, INC.

ticker: ARVN


text: The Board recognizes the importance of robust cybersecurity risk management programs and is actively engaged in overseeing and reviewing the Company's cybersecurity risk profile and exposures. The Board has overall responsibility for the oversight of the Company's enterprise risk management, including cybersecurity risks and ensuring the implementation of appropriate controls to manage these risks. The Board receives updates on the Company's ongoing cybersecurity risk management efforts, and updates on the activities of the Cybersecurity Committee at least twice per year, with more frequent updates as needed. The Board has also directed management to inform them promptly of any investigation of a material cybersecurity incident. The Board may, from time to time, engage third party advisors and experts, and meet with the Company's external advisors on cybersecurity matters, as appropriate.

companyName: SSR MINING INC.

ticker: SSRM


text: Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT security, governance, and risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct privacy and cybersecurity reviews of systems, applications, and applicable data policies; perform penetration testing using external third-party tools and techniques; conduct employee training; monitor emerging laws and regulations related to data protection and information security; and implement appropriate changes. We have implemented incident response and breach management processes that are overseen by leaders from our information security, engineering, compliance and legal teams regarding matters of cybersecurity. Security threats are evaluated, ranked by severity and prioritized for response and remediation. Potential data security incidents are investigated to determine operational and business impact, applicability of regulatory or contractual data privacy requirements, including state data breach notification statutes, and materiality We conduct tabletop exercises to simulate responses to cybersecurity incidents and collaborate with technical and business stakeholders across our business units to form detection, mitigation and remediation strategies. We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EverQuote, Inc.

ticker: EVER


text: Incident Reporting and Management the years ended December 31, 2023 and 2024, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: We manage our exposure to cybersecurity risk using various methods designed to protect against, detect, and respond to cybersecurity threats. For example, we leverage threat intelligence to identify trends and inform our understanding of the cybersecurity risk landscape. In addition, our cybersecurity team, which is led by our Vice President of Information Security, performs regular assessments of our program and conducts penetration testing to identify, evaluate, and remediate potential threats and vulnerabilities. We also engage external resources to support in the design and implementation of certain program elements, and to assist us in the prevention, detection, monitoring, mitigation, and remediation of cybersecurity risks and incidents. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of material cybersecurity incidents, we maintain a documented incident response plan to manage cybersecurity events within our environment. The response plan includes procedures for identifying, containing, and responding to cybersecurity incidents. Our ability to respond to cybersecurity incidents is tested on a recurring basis.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: Our executive team evaluates our cybersecurity risk and reports any findings, recommendations, or material impacts to the Board, which provides an oversight function. The Board has charged management with the responsibility for oversight of cybersecurity risks and incidents and any other risks and incidents relevant to our computerized information system controls and security.

companyName: INVO Fertility, Inc.

ticker: IVF


text: reporting of the scope, objectives and results of internal audits on the procedures performed to validate the effectiveness of our control environment related to our information security systems and security controls to the Audit Committee at least two times a year;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Our CISO reports to the full Board of Directors quarterly, or more frequently as needed. These reports generally address each of the six components of our Information Security program, including the Company's progress on initiatives we have prioritized for the quarter. Our Audit Committee has general oversight responsibility for our data security practices, and we believe the Committee has the requisite skills and visibility into the risk profile of our Company to fulfill this responsibility effectively. Our CTO, CISO, or other members of our Enterprise Risk Management Committee report to the Audit Committee quarterly or on an as-needed basis.

companyName: Tempus AI, Inc.

ticker: TEM


text: Processes and Risks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We maintain processes for identifying, assessing and managing material risks from cybersecurity threats including: • Ongoing development of our understanding of cybersecurity risk and its impact our systems, data, employees and capabilities through assessment of business context of information security, cybersecurity access management, information security governance and risk management strategy such as vulnerability assessments. • Ongoing development and implementation of appropriate technical safeguards to ensure delivery of critical infrastructure services through access control, awareness and training, data security, information protection policies and procedures, proactive maintenance and protective technology such as firewalls, intrusion prevention and detection systems, and anti-malware functionality. • Ongoing development and implementation of appropriate activities to identify the potential occurrence of a cybersecurity event and actions necessary to address a detected cybersecurity event through anomaly and event detection, continuous monitoring of information security and ongoing detection processes. • Ongoing development and implementation of appropriate activities necessary to address a potential detected cybersecurity event through incident response planning, communications, analysis and mitigation. We regularly assess and test our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. • Ongoing development and implementation of appropriate activities to maintain plans for cybersecurity resilience, remediation of the effects of a potential cybersecurity event and restoration of any capabilities that could be potentially impaired due to a cybersecurity event through incident recovery planning and communications preparedness.

companyName: agilon health, inc.

ticker: AGL


text: Our information security function, overseen by our Senior Vice President of IT and Facilities ("SVP of IT and Facilities") and supported by members of our IT, Legal and Finance departments, and our third-party IT service providers, helps identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example: using manual and automated monitoring tools; subscribing to reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting internal and external audits for certain data and systems; conducting threat assessments for internal and external threats; conducting vulnerability assessments to identify vulnerabilities; penetration testing; and having third parties conduct threat assessments.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Maintaining a comprehensive International Organization for Standardization-based Information Security Policy. The Information Security Policy is reviewed and certified by our Vice President of Information Technology. • Inclusion of Sarbanes-Oxley Information Technology General Controls in our Risk and Control Matrix, which are routinely tested by our Internal Audit team. • Regular risk and vulnerability assessments to identify and address potential weaknesses in our systems. We primarily utilize in-house resources for assessing, identifying and managing cybersecurity threats. • Engaging external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cybersecurity defense capabilities and recommending steps to mitigate associated threats, reduce risk, enhance our cybersecurity posture and meet our evolving needs. • Routine screening of potential and existing third-party vendors to assess their cybersecurity posture and the incremental risk that they may pose to us. Third-party vendor access to critical information systems is subject to regular review and assessment by management, and management evaluates the cybersecurity risks and safeguards of potential third-party vendors prior to engaging such vendors. • Mandatory employee cybersecurity training to equip the employees with the tools and knowledge to enhance the cybersecurity posture across the organization. • Continuous monitoring of networks and systems for suspicious activity; leveraging firewalls; intrusion detection and prevention systems; endpoint anti-virus and anti-malware solutions; and a privileged access management system. • A comprehensive incident response plan, which has been developed to enhance the Company's ability to respond to, and recover from, cybersecurity incidents.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: As part of our enterprise risk management process, we assess the various cybersecurity risks that may impact our business and implement plans and initiatives that are intended to mitigate those risks.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company, and the effectiveness of the Company's cybersecurity program to the RMC. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: The Committees have the authority to conduct or authorize reviews into areas within its scope of responsibility, which is all items impacting information security. The Committees focus on the following: Promote effective information technology and information security governance.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: To effectively assess, identify, and manage material risks from cybersecurity threats, the Company maintains a cyber risk management program, which is led by our Chief Information Security Officer and Vice President of Infrastructure Services and Supply Chain Systems (the "CISO"). The CISO reports to the Executive Vice President, Chief Information & Technology Officer (the "CITO"), who in turn reports to the CEO.

companyName: CARTERS INC

ticker: CRI


text: The Audit Committee oversees, on behalf of our Board of Directors, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO or their delegee report to our Board of Directors or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Clean Vision Corp

ticker: CLNV


text: Service Providers. Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Third-Party Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: The Company takes a multifaceted approach to assessing, identifying, and managing material risks from cybersecurity threats. The cybersecurity risk management processes described below are integrated into the Company's overall risk management system.

companyName: TRIMBLE INC.

ticker: TRMB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, forensic investigators, and cybersecurity software providers.

companyName: EVERBRIDGE, INC.


text: We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our response to—a cybersecurity incident.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: The Company maintains a formal Information Security Program that includes risk assessments regularly conducted by internal resources as well as third-party experts. These assessments are used to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. Our program leverages industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of our information assets and systems.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We have retained an industry expert to be our virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: Cybersecurity risk governance has several components that can help our organization understand and implement cybersecurity governance practices achieve long-term cybersecurity goals beyond the day-to-day information security tasks, align with legal and regulatory compliance, and the direction of the Company through: Developing

companyName: Zedge, Inc.

ticker: ZDGE


text: In the event of a cybersecurity incident, we have a plan which sets forth a framework to report such incidents to our cybersecurity incident response team. This framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. As part of this incident response plan, we have retainers in place with professional service firms to assist with cybersecurity incidents if needed.

companyName: AECOM

ticker: ACM


text: In November 2023, the Board adopted cybersecurity processes, which strengthened and formalized company-wide procedures related to identifying, managing and assessing cybersecurity threats. In the event of a cybersecurity incident which is potentially material, the SVP of IT must report such incident to the Company's CEO, CFO, General Counsel and the chair of the Cybersecurity Subcommittee, and these executives and board member determine whether, based on materiality or potential materiality, to report the cybersecurity incident to the Cybersecurity Subcommittee, which committee makes a determination if such cybersecurity incident requires a public filing.

companyName: ARKO Corp.

ticker: ARKO


text: The processes by which our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular reports from the Chief Legal Officer and Head of IT. Our Chief Legal Officer and Head of IT also provides quarterly briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses as well as the results of our risk management activities. Our audit committee provides updates to the board of directors on such reports.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We have implemented preparation for incident response, incident response and breach management processes which have four stages: 1) preparation for cybersecurity incidents, 2) detection and analysis of cybersecurity incidents, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our information security, compliance and legal teams. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Audit Committee of our Board of Directors is responsible for oversight of the Company's cyber-risk management and management's role is to assist the Audit Committee in identifying and considering material cybersecurity risks, ensure implementation of management and employee level cybersecurity practices and training and provide the Audit Committee with unrestricted access to Company personnel and documents regarding any cybersecurity attacks or vulnerabilities.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: o Investment Decisions: The board, based upon recommendation of management or our external vendors and consultants, evaluates and approves significant investments in cybersecurity technologies, training, and talent.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We maintain cyber insurance coverage that may, subject to policy terms, conditions and limitations, cover certain aspects of cybersecurity risks; however, such insurance coverage may be unavailable or insufficient to cover all losses or all types of claims that may arise in the continually evolving area of cyber risk.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: ChoiceOne recognizes the importance of cybersecurity and has established a comprehensive framework to assess and manage material risks from cybersecurity threats. The Company's cybersecurity risk management program is overseen by the Information Technology Committee, which is responsible for developing and implementing policies and procedures to protect the Company's information assets. Key members of ChoiceOne's cybersecurity team include:

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: CODEXIS, INC.

ticker: CDXS


text: In 2024, our business strategy, results of operations, and financial condition were not materially affected by risks from cybersecurity threats but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Cybersecurity and Artificial Intelligence" under Risk Factors in this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. In addition, we have implemented procedures over certain areas such as access on/offboarding and account management to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities.

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: Our Board of Directors receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics. These topics include, but are not limited to, updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources, environmental threats and vulnerability assessments, and efforts to prevent, detect, and respond to potential gaps, internal and external incidents, and critical threats. At least quarterly, our Board of Directors discusses cybersecurity and information security risks with our CIO. Our Board of Directors is also required to complete cybersecurity training and participate in a cloud computing education session annually. Our policies and processes are designed such that the Board of Directors would receive prompt and timely information from Bank management on any cybersecurity or information security incident or threat that may pose significant risk to us and would continue to receive regular reports on any incident until its conclusion.

companyName: Federal Home Loan Bank of Des Moines


text: Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the firm's data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with our business segment teams to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment, and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as our acceptable use policy, upon hire and annually.

companyName: Carlyle Group Inc.

ticker: CG


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats and best practices as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's information security policies, standards, processes and practices.

companyName: LKQ CORP

ticker: LKQ


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: scPharmaceuticals Inc.


text: Additionally, eHealth has engaged a guided cyber crisis response platform and conducted a mock cyber-attack exercise to build crisis management experience for our senior leadership and cybersecurity teams. We believe this voluntary skill building exercise put our teams in a better position to manage a potential cybersecurity crisis.

companyName: eHealth, Inc.

ticker: EHTH


text: We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response team (i) includes subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Risks from cybersecurity threats, including as a result of the Previously Disclosed Cyber Incident, have materially affected us, including our results of operations and financial condition. We continue to face risks from this and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See "Risk Factors – Technology Risks."

companyName: KEY TRONIC CORP

ticker: KTCC


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains policies and procedures relating to our data collection, use and processing activities, as well as mechanisms for monitoring our data systems and usage. We do not have individual retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws in the countries in which we operate, including the GDPR, the U.K. Data Protection regime and the California Consumer Privacy Act (the "CCPA"). • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Our Security Team also monitors security through the entire software and product development lifecycle. The Head of Application and Product Security is accountable for the release or deployment approval of a product based upon the review of internal and external validation (functionality, performance, security) reports.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: h. Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the the Company's VP of Information Technology, Security and Business Intelligence and other members of the cyber team and management.

companyName: Axogen, Inc.

ticker: AXGN


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: Mr. Lyke is notified real time by the managed service provider for matters requiring immediate attention. Mr. Lyke also reviews a standardized monthly report with key IT systems data and statistics, including red flags requiring resolution, if any. Management reports serious cybersecurity incidents to the Committee and our Board.

companyName: MAYS J W INC

ticker: MAYS


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We conduct regular risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factors entitled "We are increasingly dependent on information technology systems, infrastructure and data. Cybersecurity breaches could expose us to liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business," and "Our internal computer systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of development programs for our product candidates," in Part I, Item 1A of this Annual Report on Form 10-K, each of which is incorporated herein by reference.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: To mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network and endpoint monitoring. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: The Risk Committee of the Board provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Risk Committee receives periodic presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Risk Committee also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The full Board receives reports from the Risk Committee related to information cybersecurity.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and CEO. The CFO and CEO work with the Director of Information Technology to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Board certain cybersecurity incidents.

companyName: Tracon Pharmaceuticals, Inc.


text: The audit committee of our Board is responsible for oversight of risks from cybersecurity threats. The Information Technology Director presents an update on cybersecurity risk management to the audit committee of our Board during quarterly meetings and the audit committee provides relevant updates to the Board.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: Our board of directors addresses Sangamo's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Operating Officer and, as appropriate, the Chief Compliance Officer and the Director of Information Technology, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company's Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company's Senior Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company's ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Processes for managing cybersecurity risks related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, CyberTeam oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps are taken.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: Our Director of IT and Director of IT Security and Compliance assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT and IT Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Notwithstanding our defensive measures and processes, the threat posed by cyber–attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. See Item 1A. Risk Factors for further discussion of risks related to cyber security in Horizon's 2023 Annual Report on Form 10–K filed with the Securities and Exchange Commission. HORIZON BANCORP, INC.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Engage Third Parties As part of the Corporation's cybersecurity risk management process, the Corporation engages a range of third parties, including consultants and advisors, to assist with security assessments and operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and the Corporation's vulnerability management platform. These relationships enable the Corporation to access specialized knowledge and insights with respect to its cybersecurity strategies and processes.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Mr. Srinivasan is responsible for network operations across our 41-state footprint. He joined Charter in 2016, and most recently served as Senior Vice President in Network Operations, first in Core and Backbone Operations and most recently in Video Operations. Prior to that, he served in several senior engineering roles at Time Warner Cable Inc. ("TWC"), including as Group Vice President of Commercial Engineering and Operations, Vice President of Commercial Engineering for TWC's West Region, and Director in the Texas Region. Mr. Srinivasan began his career at Sprint Corporation in a series of engineering roles with increased responsibility. He received a bachelor of science from Anna University, a master's degree and doctorate in materials science from Kansas State University, and a master's degree in business administration from the Graduate School of Business at the University of Kansas.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: We routinely evaluate third-party certifications (such as SOC and Insurance Services Office reports) for applications within the scope of our financial audits, supplementing these with bridge letters and internal controls when necessary. Additionally, our security team uses advanced software to assess third-party security postures, providing maturity scores that inform risk management and foster continuous improvement throughout our partnerships.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including, among others, the Chief Financial Officer, Head of IT, and Associate Director of IT Operations. Our Head of IT is an IT security professional and members of our IT Department have certain credentialling in cybersecurity. We also rely on third-party security analysts who have certain certifications related to cybersecurity.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our Director of Information Technology, Chris Dennis, is responsible for our day-to-day assessment and management of cybersecurity risks. Mr. Dennis has served as our Director of Information Technology since June 2019. Mr. Dennis additionally is the founder of a data privacy consulting company and has over 20 years of experience in the data management space. We have implemented a number of processes which allow Mr. Dennis and his team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Mr. Dennis and his team share such information with our management team and reports information about such risks to our Audit Committee.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: audits, and IT security reviews. To defend, detect, and respond to cybersecurity incidents, we perform cybersecurity reviews of systems and applications; audits of applicable data policies; vulnerability assessments and penetration testing using external third-party tools to test security control; security incident and event management; continuous monitoring, and threat intelligence gathering; conduct employee training; and implement appropriate changes.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: We maintain incident response and recovery plans that direct our response to cybersecurity incidents. These plans guide how we evaluate and assign incident severity levels and reporting thresholds, escalate and engage cross functional incident response teams, perform materiality assessments, and manage and mitigate the related risks. We also maintain a cybersecurity insurance program to reimburse covered costs, losses and claims relating to a data or security breach.

companyName: Hillenbrand, Inc.

ticker: HI


text: The Company maintains a formal and comprehensive enterprise-wide Information Security and Cybersecurity Program (the "Information Security Program") that protects the confidentiality, integrity, and availability of the Company's information assets and to manage reasonably foreseeable cybersecurity risks and threats. The Information Security Program, which is in compliance with banking regulations, includes a threat intelligence program, policies and procedures, multi-layered cybersecurity technical safeguards, third-party security risk assessments, a formal incident response program, mandatory trainings for employees and independent contractors upon hire and regularly thereafter, annual audits, and reviews of vendors who handle sensitive information.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a CIO or CTO of two other large publicly traded companies. He provides overall leadership and guidance for the company's technology department, including the cybersecurity team. He holds an MBA in international business from The Ohio State University, an MCA in computer science from the University of Mumbai, a BS in physics from the University of Madras and has been with us since 2021.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: Our overarching approach to cybersecurity risk management centers on governance, people, processes, and technology. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. This includes mandatory annual cybersecurity training and monthly phishing simulations. We also perform periodic tabletops or simulation exercises involving technical experts and business and functional leaders.

companyName: Option Care Health, Inc.

ticker: OPCH


text: We engage third parties to conduct annual penetration testing, and we use external risk assessors to measure our program to industry standard frameworks. Our information security management system is certified to the ISO/IEC 27001:2013 and 27017:2018 standards by the British Standards Institution (BSI); certificates IS 780367 and CLOUD 806141,respectively. We also collaborate with experts and industry partners to exchange information about threats, best practices, and trends.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: The Corporation conducts periodic testing of software, hardware, defensive capabilities, and other information security systems utilizing both internal processes and third-party consultants. Testing procedures are supplemented by regular cyber threat exercises and employee training. Threat simulation exercises are used to develop and refine the Corporation's incident response plans. A defense-in-depth strategy is utilized to provide various layers of defense to identify and protect against risks to the Corporations network and computer systems. We utilize industry standards such as but not limited to; advanced firewall, content filtering, email gateway protections, endpoint detection and response software, and data loss prevention software.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: Index to Financial Statements Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: As one of the critical elements of the Company's overall risk management, our Manager's cybersecurity program is focused on the following key areas:

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition.

companyName: BV Financial, Inc.

ticker: BVFL


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, as well as a description of an event that occurred in March 2023, see "Risk Factors—Risks Related to Our Business—Security breaches, loss of data, and other disruptions could compromise sensitive business or patient information, cause a loss of confidential patient data, employee data, personal information, or prevent access to critical information, and expose us to liability, litigation, and federal and state governmental inquiries and damage our reputation and brand."

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: As its reliance on information technology systems and data has increased, the Company obtained cybersecurity insurance and utilizes third party risk assessments.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: To date, the risks from cybersecurity threats have not materially affected the Company. We have significantly increased our cybersecurity investments over the last five years and have implemented cybersecurity safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company. Notwithstanding our increased cybersecurity investments and preparedness activities, sophisticated and targeted computer crime perpetrated by threat actors internal or external to the Company poses a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property and confidential and personal data. This could lead to negative publicity, theft or other financial loss, modification or destruction of proprietary information or key information, manufacture of defective products, production downtimes and operational disruptions, which could materially and adversely affect our reputation, competitiveness and results of operations. Refer to the risk factor titled "The security of our information technology systems could be compromised which could adversely affect our operations or reputations" in Item 1A of this Form 10-K for further detail regarding cybersecurity risks that could affect PPG's operations. We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: Employee Training and Awareness: A strong security culture among our employees is one of our best defenses in relation to cybersecurity events. Our employees are required to complete annual cybersecurity and data protection awareness training. This training educates personnel on topics like phishing prevention, safe computing practices, and how to report potential security issues. We supplement formal training with periodic phishing email simulations and security reminders.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: As a key component of this governance framework, the Audit Committee and Technology Committee also receive regular updates regarding our cybersecurity program and cybersecurity incidents from our Chief Information Security Officer.

companyName: HUMANA INC

ticker: HUM


text: Our cybersecurity incident response plan is designed to escalate cybersecurity incidents, depending on the circumstances, to our senior management team and Audit Committee of the Board of Directors. As part of such process, the Audit Committee of the Board of Directors receives regular reports from our Senior Vice President, Information Technology concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: The Audit Committee receives regular reports (at least quarterly) from our CISO and our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.

companyName: FLEX LTD.

ticker: FLEX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, third party service providers and other employees, who we believe have a combination of relevant expertise, experience, education and training.

companyName: Marker Therapeutics, Inc.

ticker: MRKR


text: Roles and Expertise Cybersecurity responsibilities are primarily assigned to the Company's external IT specialist, who brings extensive experience in network security, infrastructure protection, and cybersecurity threat mitigation.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: When a potential threat or incident is identified, our cybersecurity incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our chief information security officer (CISO) and chief information officer (CIO). Our CISO, CIO, and key leaders will determine whether and what elements of our cybersecurity incident response plan should be activated, including escalation to our Executive Committee and/or members of our Board of Directors as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.

companyName: Catalent, Inc.


text: Engagement of Third Parties in Connection with Risk Management The Company engages various third parties to evaluate the effectiveness and maturity of the Program. The Company engages an independent third party to audit the cybersecurity risk strategy and preparedness. The Company also maintains cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured. The Company also engages third parties to perform regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate threat actor attacks. Our relationships with third parties enable us to leverage their cybersecurity expertise and industry knowledge to assess our Program and adjust as needed.

companyName: F&M BANK CORP

ticker: FMBM


text: The Company relies on third-party service providers for services such as IT management and payroll. These third-parties are also vulnerable to cybersecurity threats. Management actively assesses its third-parties policies related to cyber risks, including obtaining System and Organization Controls (SOC) reports, when available.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: b Leveraging external service providers, including assessors, consultants, auditors, and other third parties, to assess, test, monitor, and respond to cybersecurity threats in an attempt to maintain robust security controls. aEstablishing processes to oversee and identify cybersecurity risks associated with third-party service providers.

companyName: IREN Ltd

ticker: IREN


text: As of the date of this report, we are not aware of any material breaches to our networks or computer systems that have materially affected or are reasonably likely to materially affect us, including the execution of our business strategy, results of operations, or financial condition. We describe potential risks from cybersecurity threats under the heading "Our information technology systems can be negatively affected by cybersecurity threats," in Part I — Item 1. "Risk Factors" of this 2023 Form 10 K, which disclosures are incorporated herein by reference.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: Members of our Cyber Oversight Group also include our Chief Executive Officer, Chief Financial Officer, Chief Legal and Risk Officer, Senior Director of Internal Audit, VP of International Technology, and technology and data privacy in-house counsel. The Cyber Oversight Group is also tasked with reporting to the Audit Committee on cybersecurity risk management strategies, as well as any significant cybersecurity incidents that may occur. In addition, the Cyber Oversight Group meets at least four times per year, or with greater frequency as necessary, to, without limitation: • review with management the Company's cybersecurity threat landscape, risks, and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security and data protection laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies as to risk assessment and risk management, including the guidelines and policies established by the Company to assess, monitor, and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, technology and information systems, including cybersecurity incident response preparedness, communication plans, and disaster recovery capabilities.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: Our IT manager skills are further enhanced by MCSA and MCSE certifications and a foundation in Computer Engineering studies at university. Our IT manager has a strong track record of working with major vendors' security, firewall, identity management, and other platforms, ensuring robust and resilient IT infrastructures.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Cybersecurity and cybersecurity risk management are important aspects of operations and a focus area for the Affiliated Group. Cybersecurity risks are evaluated on an ongoing basis by the Affiliated Group and its IT Provider, both internally and with the assistance of external firms.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: We face a number of cybersecurity risks in connection with our business. To date and to our knowledge, we have not experienced a material cybersecurity incident, and cybersecurity threats have not had a material impact on our business strategy, results of operations, or financial condition. However, we have, from time to time, experienced threats to and infringement of our data, policies and systems in the ordinary operation of our business. For more information about the cybersecurity risks we face, see the risk factors in Part I, Item 1A. Risk Factors entitled "Increased cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks could pose a risk to our systems, networks, solutions, services and data." and "We are dependent on third parties for the execution of certain critical functions and the failure or inability to perform on the part of one or more of these third parties could materially and adversely affect our reputation and our business.".

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: The B oard of Directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value. The Director of IT provides a report to the Board of Directors on an annual basis, or more frequently as needed, with respect to information security activity, security assessments, controls and investments.

companyName: ASTRONICS CORP

ticker: ATRO


text: Our cybersecurity risk management program primarily leverages the National Institute of Standards and Technology Cybersecurity framework (NIST CSF). We routinely assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our risk management program also assesses third party risks to attempt to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. As part of our cybersecurity risk management program, we also gather Threat Intelligence through our multiple security partners and tools. This intelligence (including tactics, techniques and procedures used by cyber criminals) provides insights into potential threats and vulnerabilities, which helps us to defend against cyber-attacks.

companyName: APi Group Corp

ticker: APG


text: We identify our cybersecurity threat risks by comparing our processes to standards set by the NIST and the ISO specifically basing our policies and procedures on ISO 27001 guidelines.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our CISO also has over 35 years of information technology experience. He is a 10-year U.S. Air Force veteran and has held technology positions in infrastructure management and operations with Raytheon and Blockbuster. He also maintains Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.

companyName: Vistra Corp.

ticker: VST


text: Our CTO is informed about, and monitors the prevention, detection, mitigation and remediation of, cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, annual external penetration testing using an experienced third-party company; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; cryptography and encryption; data erasure and media disposal, regular data backups and restoration processes; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment and provide contractual assurances relating to their security responsibilities, controls, reporting, and roles and responsibilities with regard to cybersecurity. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.

companyName: AMC Networks Inc.

ticker: AMCX


text: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at CTO, the Company and similar companies, including risks arising from cybersecurity threats.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: Our cyber policies are based on NIST and cyber coverage standards, requiring formal written policies, procedures, plans of action, general security plans and regular audits.

companyName: Southland Holdings, Inc.

ticker: SLND


text: In addition, we have established a Data Privacy Committee coordinated by our Data Privacy Officer and represented by seven other committee members from various corporate functional departments. The objective of the Committee is to ensure that personal data is protected and handled in accordance with applicable law and Core Lab policies.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the SDIS and DPO and comprised of other members of management. This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Cybersecurity Risk Management and Strategy CRH leverages its Enterprise Risk Management (ERM) framework to identify, assess, respond, monitor and report material cybersecurity risks facing the Company. CRH manages cybersecurity risk at multiple levels within the Company. Given CRH's wide geographic spread, the frequency and possible scale of acquisition activity, the diversity of the types of IT systems operated by CRH companies and the decentralized nature of its operations, CRH implements an amalgam of centralized and decentralized processes for IT management. Under this model, Company-level management and the management of CRH's operating subsidiaries and business units share responsibility for cybersecurity management and collaborate on assessing, identifying, and managing material risks.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Executive Director of IT, who has 25 years of experience developing and deploying network and data security policy and technology.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Third-Party Auditors and Consultants in Cybersecurity Risk Management Our cybersecurity team also periodically engages third-party cybersecurity experts for risk assessment and system enhancements. We utilize third-party auditors and assessors in connection with our cybersecurity risk management program to identify gaps and develop policies, procedures, and strategies designed to improve the cybersecurity program. We also use third-party consultants to obtain and will use them to maintain relevant organizational cybersecurity certifications, including UN Regulation 155 Vehicle Cybersecurity Approval. As a general matter, we have from time-to-time utilized third-party cybersecurity consultants on an ad hoc basis in specific instances, including (i) to address potential cybersecurity threats and incidents, (ii) to conduct cybersecurity assessments and penetration testing on high-value systems and applications; and (iii) to develop internal capabilities to improve our cybersecurity defense.

companyName: Lucid Group, Inc.

ticker: LCID


text: The Company, through its Chief Information Security Officer ("CISO"), other Company employees experienced in information network security, and the use of third-party expertise, references various recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. These frameworks are used to benchmark and tailor the Company's cybersecurity strategies and program to our risk profile and specific operational needs and goals. Our core cybersecurity strategy focuses on five key pillars: identification, protection, detection, response, and recovery, each tailored to meet the specific challenges and needs of our business. The primary goal of this strategy is to proactively safeguard the confidentiality, security, and availability of the information we collect and store. This proactive approach includes attempts to identify, prevent, and mitigate cybersecurity threats, as well as preparing to quickly respond to cybersecurity incidents to minimize their impact. Under the leadership of our CISO and CRC, we regularly evaluate and enhance our cybersecurity practices to facilitate adaptation to the constantly evolving landscape of cybersecurity threats.

companyName: REGENCY CENTERS LP


text: Our Executive Director of Information Technology, or IT, and other relevant personnel help identify, assess and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We (including the Executive Director of IT) use various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal audits, conducting threat assessments, conducting third-party threat assessments, and conducting vulnerability assessments.


text: To mitigate the cybersecurity risk associated with the use of third-party service providers, we tier our third-party service providers based on their risk profile to establish applicable cybersecurity risk review standards and evaluate those providers in accordance with the tiering process. BBSI also relies on its third-party service providers to maintain cybersecurity control environments that address the risks associated with the products and services they provide to BBSI.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: Our board of directors delegated to our audit committee oversight of cybersecurity and other information technology ("IT") risks. Our audit committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the audit committee as necessary regarding any significant cybersecurity incidents.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Our cybersecurity function, led by our head of IT and supported by our third-party service providers, is responsible for our cybersecurity risk management and strategy processes. These functions have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Our risk management strategy includes, among other elements: • Identification: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel. • Assessment: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. • Management: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.

companyName: T Stamp Inc

ticker: IDAI


text: Our Board of Directors (Board) appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Corporation. The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) primary responsibility for oversight of our risk management practices, including oversight of cybersecurity and other information technology risks.

companyName: HESS CORP


text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depend in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

companyName: FEDEX CORP

ticker: FDX


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Our audit committee also receives prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Hyperfine, Inc.

ticker: HYPR


text: MPC's CISO works at the direction of MPC's CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers.

companyName: MPLX LP

ticker: MPLX


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. We utilize cybersecurity consultants to monitor and report cybersecurity threats or incidents to our chief financial officer and to resolve issues arising from such threats or incidents. Our chief financial officer updates the Nomination and Corporate Governance Committee on any risks related to cybersecurity as needed.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: Our CIO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Cybersecurity for public and private companies. Our CIO holds an undergraduate degree in computer science and has attained a professional certification in Cybersecurity Governance. The Cybersecurity team (including the CIO) have a combined 80+ years of cybersecurity experience and hold multiple certifications across the cybersecurity landscape. Our CEO, CFO, COO, SVP HR and Senior Vice President and General Counsel each hold undergraduate degrees, graduate degrees or professional certifications in their respective fields, and each have significant experience managing risk.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: We have an established cyber risk appetite, framework and policies to support risk-based decisions on where and how to allocate security resources. The management of cybersecurity related risks is integrated into our overall enterprise risk management process. Risks are regularly identified, assessed, monitored and reported on to ensure that we are able to allocate security resources appropriately. Risks get reported at divisional, executive and Board risk committees.

companyName: Flutter Entertainment plc

ticker: FLUT


text: The Company's management, including the Company's CIO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CIO and CISO each have more than 20 years of experience in cybersecurity. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Human Resources, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: Oceaneering's cybersecurity risk management program is overseen by management at multiple levels. The CITO and the Director of IT Security play key roles in assessing, monitoring and managing the Company's cybersecurity risks with support of the Enterprise Risk Committee, as well as dedicated information technology and security personnel. Our CITO has 20 years of experience as an information technology executive, and earned a Bachelor's and Master's degrees in Management Information Systems. Our Director of IT Security has 25 years of experience managing global information technology security and has served as Oceaneering's CISO since 2018. Our Director of IT Security earned a Bachelor's degree in Business and has several relevant certifications including Risk and Information Systems Control ("CRISC"), Information Systems Auditor ("CISA"), Information Systems Security Architecture ("ISSAP"), Security Certified Network ("SCNP"), Information Systems Security ("CISSP") and Cisco Certified Network Associate ("CCNA").

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: The Board, in coordination with the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the Audit Committee include overseeing policies and management systems for cybersecurity matters and reviewing HighPeak Energy's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the Audit Committee receive regular presentations and reports on cybersecurity risks that address a range of topics, including developments, technological trends or tools, third party updates, and regulatory standards. The HighPeak Energy IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity with our executive officers and cybersecurity personnel.

companyName: HighPeak Energy, Inc.

ticker: HPK