text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Senti Biosciences, Inc.

ticker: SNTI

secItem: Item 1C


text: Our internal cybersecurity governance program is led by Mammoth's Director of Information Technology, with support from the internal information technology department, who reports to our Chief Financial Officer. Our Director of Information Technology has over six years of technological leadership experience along with an extensive background in computer support and application support. The Director of Information Technology and her team are responsible for leading cybersecurity strategy, policy, standards, architecture, and processes within our organization. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents. This team continuously identifies potential cyber vulnerabilities and opportunities for improvement, including yearly security training for all employees. This team also continuously evaluates and implements technological enhancements as part of our cybersecurity systems. Progress and developments in our cybersecurity governance program are regularly communicated to our executive team. Our board of directors, as part of its oversight process, receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that have occurred.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. While we devote resources to security measures designed to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. A successful attack on our information technology systems or on the systems of our third-party vendors could have material consequences on our business. We describe whether and how risks from cybersecurity threats have or are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Risks Related to Our Intellectual Property, Cybersecurity and Data Privacy" included as part of Part 1, Item 1A, Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: A significant portion of our data storage, communications, and operational systems are hosted or managed by third-party vendors. While we perform diligence and require certain contractual security obligations, we do not directly control these external systems. As a result, our operations may be impacted by cybersecurity vulnerabilities or incidents affecting our vendors.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: The Company's Chief Information Security Officer ("CISO") and Vice President, Chief Audit Executive, who oversees the Company's enterprise risk management ("ERM") framework, partner on definition and treatment of cyber risks. Cybersecurity is a component of the Company's ERM framework and processes. The Company utilizes a range of capabilities to help identify and assess potential cyber threats and vulnerabilities, which feed into the development and regular updating of a risk mitigation plan to help manage the Company's cybersecurity risk posture. The Company evaluates cyber security risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform areas of focus and prioritization.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our Third-Party Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Audit Committee of the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cybersecurity attacks or other compromise. The Company's IT team consults with, and provides regular updates to, our Audit Committee, as well as members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of our cybersecurity program, and timely reports regarding any cybersecurity attack that meets established reporting thresholds. Our Audit Committee has oversight responsibility for our cybersecurity program.

companyName: GameStop Corp.

ticker: GME


text: Our IT department is made up of experienced professionals with an extensive background in information security, risk management and incident response. Our Vice President of IT leads our IT department, which is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Vice President of IT reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. To facilitate effective oversight, our Vice President of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: Our security team, including our Governance Risk and Compliance lead (GRC) and CISO, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has 25 years experience as a technology leader, with extensive experience within the cybersecurity ecosystem and risk management. He has been certified as a CISO by the Israeli Technion Institute. Our security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Teads Holding Co.

ticker: TEAD


text: The Risk & Technology Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Risk & Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: At least annually, the Board of Directors reviews and approves the risk management program and policies based on information presented throughout the year from the ERM Committee and the Management Risk Committee.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Risks Related to Our Business and Operations—A material breach in security relating to our information systems could adversely affect us." within Item 1A, "Risk Factors" in this Annual Report.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that we face, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A ( "Risk Factors – Our business could be adversely affected by a security breach or other attack involving our computer systems or those of one or more of our vendors.") in this Annual Report.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents. We did not incur any expenses related to penalties and settlements.

companyName: G1 Therapeutics, Inc.


text: Engagement of Third Parties We engage third-party cybersecurity consultants and experts to supplement staffing of our SOC as well as to assess, validate, and enhance our security practices, including conducting cybersecurity maturity assessments, vulnerability assessments, and penetration tests. As part of the incident response process described above, we engage third-party experts as needed to support the incident response team, such as external legal advisors, cybersecurity forensic firms, and other specialists.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, or availability of our information technology systems or data, and those maintained on our behalf, could lead to adverse consequences that materially adversely affect our business, including, without limitation, regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."

companyName: Annexon, Inc.

ticker: ANNX


text: Cybersecurity is among the most critical risks to the Company. For many activities important to its business, the Company depends on the confidentiality, integrity, and availability of information systems and data, some of which are provided or managed by third parties.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: To manage our material risks from cybersecurity threats, we take certain measures, including the below listed activities, depending on the nature of the relevant systems, data, and environment: • undertaking period reviews of our consumer-facing policies and statements; • conduct phishing email simulations for employees and contractors with access to corporate email systems; • require employees, and certain service providers, to treat customer information with care; • running tabletop exercises to simulate a response to a cybersecurity incident; • carrying cybersecurity insurance that provides protection against the potential losses arising from a cybersecurity incident; • conducting annual cybersecurity awareness training for employees; and • maintaining an incident response plan to prepare for, detect, respond to, and recover from, cybersecurity incidents.

companyName: Sunrun Inc.

ticker: RUN


text: Our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic processes covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture, the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Outside of quarterly presentations, the chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the audit committee would also be expected to review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the Securities and Exchange Commission. Through their participation in meetings of the audit committee, other members of the Board are also kept apprised of material risks from cybersecurity threats and our related risk management activities.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Finally, management has instituted our Information Security Council and Enterprise Risk Management Council both of which are made up of senior leaders of the Company. The Information Security Council is tasked with overseeing information security matters at Edwards, including cybersecurity. This council serves as an escalation point for issues requiring concerted action, and in turn, informs executive management regarding information security and cybersecurity risks and issues. The Enterprise Risk Management Council is tasked with proactive management of our enterprise-wide risks, including information security risks that also include cybersecurity. This council is responsible for assessing, and providing input into, the enterprise risks that are presented to the Board of Directors.

companyName: Edwards Lifesciences Corp

ticker: EW


text: While we have experienced cybersecurity incidents that resulted in the disruption of our information technology systems and required us to engage third parties to remediate the issues, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, results of operations, or financial position. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, results of operations and financial position. See Item 1A "Risk Factors - We rely extensively on information technology systems, and cybersecurity incidents could adversely affect us."

companyName: OMNICOM GROUP INC.

ticker: OMC


text: OFG uses external consultants and other third-party service providers to monitor our information systems for any cyberattacks, impersonators or unauthorized releases of sensitive customer data, as well as performing investigations and penetration testing, identifying system vulnerabilities and required software patches, monitoring and managing firewalls, and advising on systems and cloud architecture. OFG also conducts due diligence of third-party software and related services and reviews cybersecurity reports from technology services providers to ensure that our cybersecurity infrastructure can respond to evolving cybersecurity risks relevant to our business. Pursuant to our cybersecurity risk management framework, our Information Security team develops an annual information security awareness plan to educate employees as to OFG's standards, processes and practices with respect to information security, potential cybersecurity threats and proper use of information security resources entrusted to them, with the goal of minimizing possible employee security risks. Our Information Security team engages third-party consultants to assist us in the evaluation of our cybersecurity risk management practices to identify risks, perform social engineering exercises, and provide annual cybersecurity training.

companyName: OFG BANCORP

ticker: OFG


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board and its Audit Committee have ongoing oversight roles. The Audit Committee reviews and discusses with management, including reports from our Chief Innovation Officer, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures, • the assessment of risks and threats to our information technology systems, • the internal controls regarding information technology security and cybersecurity, and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks. The Audit Committee also periodically receives reports on notable cybersecurity incidents and briefs the full Board on these matters.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: We use cybersecurity consultants and penetration testing firms in an effort to identify, assess, and manage material risks from cybersecurity threats. We use third-party service providers in various elements to our business operations such as data hosting providers. To help manage cybersecurity risks associated with our use of third-party service providers, we primarily engage with industry-preferred service providers, and we also contractually require service providers with access to personal, confidential, or proprietary information to maintain data security controls and practices.


text: The IT and Audit committees actively participate in discussions with management regarding cybersecurity risks. The IT Committee and Audit Committee assess the Company's cybersecurity program at least annually, including discussing management's actions to identify and detect threats, and scenarios for potential response or recovery situations. In addition to regularly scheduled meetings, the IT and Audit Committee and appropriate senior management levels maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: General Overview Information, including but not limited to proprietary information and personally identifiable information, is one of the Company's most important assets. Protection of our information assets is necessary to establish trust with our clients, fulfill our fiduciary responsibilities, maintain regulatory and legal compliance, and protect our reputation.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Our programs are designed to identify and categorize cybersecurity threats and risks through different sources. We conduct assessments of threat models to determine which risks are most likely to impact us. Akamai's information security team gathers threat and risk data and updates through various sources, such as systems reviews, security research activities, product development processes, diligence efforts in acquisitions and internal and external security scans and alerts, as appropriate. As applicable, in certain circumstances, we also collaborate with industry partners in the security community, our peers and law enforcement agencies, to support our cybersecurity threat intelligence capabilities. This information is collected, categorized and assessed to identify, prioritize and manage significant cybersecurity risks. As a result, our process is continually evaluated and evolves as the threat landscape changes. In addition to ongoing risk management procedures, we have implemented a cybersecurity incident procedure designed to identify and address security incidents through various channels. As part of this process, cybersecurity incidents are evaluated, as appropriate, by a cross-functional team to assess the impact of the incident or threat to Akamai from a financial, reputational and operational perspective, and to determine notification obligations to customers and regulators and disclosure obligations to investors, as applicable. The results of such evaluation are discussed with the board of directors as appropriate. On a regular basis, our cybersecurity professionals conduct internal assessments of this process. Additionally, we have implemented an incident response plan that is reviewed by the Audit Committee and the board of directors from time to time.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Our Board of Directors, as a whole and at the committee level, has oversight of the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. Our Audit Committee, which is comprised solely of independent directors, oversees our cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Director of Information Technology as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: BIORA THERAPEUTICS, INC.


text: We perform vulnerability and threat monitoring mitigation activities on a regular basis and perform a cybersecurity risk assessment at least annually. Our cybersecurity risk assessment program includes the following assessments and activities: • ensure program alignment with the NIST Cybersecurity framework; and, • prioritize, remediate and ensure effectiveness of critical applications, infrastructure, and information.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We conducted a NIST risk assessment and perform as needed updates to our risks to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We engage a managed service provider ("MSP") and other third parties in connection with our cybersecurity and information technology risk assessment processes and our MSP also assists us with managing and monitoring our network and local compute systems. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through communications.

companyName: Empery Digital Inc.

ticker: EMPD


text: As of the date of this Form 10-K, we do not believe any risk from any cybersecurity threats or incidents have had, or are reasonably likely to have, a material impact on us; however, there is no guarantee that a future cybersecurity threat or incident will be detected and remediated to not have a material adverse impact on our business, results of operations and financial condition. Refer to Item 1A - Risk Factors of this Form 10-K for information on cybersecurity risks that may materially affect our business, results of operations and financial condition.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: We employ strong password standards for our systems and applications. We also employ firewalls across our infrastructure to guard against threats. We provide ongoing security training to our employees and contractors about information security policies and practices, including phishing simulations.

companyName: Vynleads, Inc.

ticker: VYND


text: Signet faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Signet does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition. However, Signet (or third parties on which Signet relies) may not be able to implement security controls fully, continuously and effectively as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security controls to implement, and it is possible that Signet may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties on which Signet relies). See the "Risk Factors" section in Item 1A of this Annual Report on Form 10-K for additional discussion of our cybersecurity risks.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: –Segregation of our financial data records, that are stored on remote servers, separate and apart from our corporate office network with backups stored in different geographical regions in the United States.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us, our business strategy, results of operations, or financial condition.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: Hubbell recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data, networks and technology assets. Cybersecurity related risks are included in the risk universe that our enterprise risk management program evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop mitigation plans, which are then tracked to completion. Cybersecurity related risks are also considered as part of our business continuity and resiliency planning. Business continuity plans establish risk management processes and procedures to mitigate interruptions to business activities, including from cybersecurity incidents.

companyName: HUBBELL INC

ticker: HUBB


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Company's day-to-day risk management is under the direction of Jason J. Bundick, the Company's Executive Vice President, Chief Compliance Officer, General Counsel and Secretary. Jason Osbeck, the Company's Senior Vice President of Information and Technology, is responsible for day-to-day cybersecurity risk management under the direction of Mr. Bundick. Mr. Osbeck has served in this role at the Company since 2012.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Chief Executive Officer who reports to the board of directors.

companyName: Authentic Holdings, Inc.

ticker: AHRO


text: To date, no attempted cyber-attack or other attempted intrusion on the Company's information technology networks has resulted in a material adverse impact on the operations or financial results of the Company or the Bank.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Our security team follows an incident response process which we are continuing to evaluate and enhance. Pursuant to this process, incidents which may result in economic loss to the company, reputational harm or require notifications to individuals and government authorities are reported to our executive team as they are occurring. Our Chief Security Officer also provides a quarterly summary of investigations given to an executive data council, and our Data Privacy Officer reports on our compliance posture with respect to new and pending laws and regulations.

companyName: Unity Software Inc.

ticker: U


text: The use of these third -party providers is regularly reviewed and monitored by the appropriate members of management. We conduct thorough assessments of all third -party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: We back up our systems and data to mitigate the impact of a cybersecurity event that would impact our ability to operate or result in the loss of data. We partner with strategic managed cybersecurity service providers to supplement the capabilities of our internal team. We update and refine our CIRP in response to identified risks.

companyName: JBG SMITH Properties

ticker: JBGS


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Head of Information Technology of Oxford Funds, manages the Company's cybersecurity program. The President and CCO of the Company oversee the Company's oversight function generally and rely on Oxford Funds' Head of Information Technology to manage the assessment and management of material risks from cybersecurity threats. The Head of Information Technology has more than 8 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for his oversight function as CCO to the Company for 8 years and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: Our CISO has primary responsibility for our overall cybersecurity risk management program, and directly supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CISO has over 19 years of experience in cybersecurity including security operations, security architecture, identity and access management, cloud security, vulnerability management, and application/product security, policy, and compliance.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cybersecurity professionals that manage the operational technology (OT) network security of IPALCO to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and IURC regulation.

companyName: IPALCO ENTERPRISES, INC.


text: • The Board of Directors conducts informed oversight of our risk management processes. The Audit Committee of the Board of Directors has primary responsibility for oversight of enterprise risk management and cybersecurity risk management. Reports on enterprise and cybersecurity risk, risk treatment plans, and key performance indicators of our cybersecurity program are provided to the Audit Committee by management, including our Chief Information Security Officer (CISO), on a quarterly basis and are provided to the Board of Directors as requested and as part of routine Audit Committee updates to the Board of Directors. • The Executive Leadership Team (ELT), a cross-functional leadership group that includes our Senior Vice President, Information Systems, is responsible for assessing and managing enterprise risks, including cybersecurity risks. The ELT reviews enterprise and cybersecurity risks, risk treatment plans, and key performance indicators regarding the Company's enterprise risk and cybersecurity risk management programs quarterly. • The CISO is responsible for cybersecurity strategy and reporting on cybersecurity risks to the ELT, Audit Committee, and Board of Directors. The CISO collaborates with a cross-functional group of the Company's business leaders to assess cybersecurity risk, establish and monitor cybersecurity processes, and report program effectiveness. Our CISO has over 25 years of cybersecurity and information technology experience across multiple industries with expertise in governance, risk and compliance, cybersecurity operations and cybersecurity engineering. • The Cybersecurity Advisory Committee supports cybersecurity risk assessment, advises on program enhancements, and acts as a cybersecurity advocate across the business. The committee is comprised of employees with extensive experience across a diverse range of disciplines. • All employees are responsible for adherence to the Company's cybersecurity processes and for remaining vigilant to potential cybersecurity threats. This responsibility is part of our employee commitment to operational excellence and is strengthened by ongoing cybersecurity education, training, and awareness programs.

companyName: Infinera Corp


text: Our VPE&T, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. The information security organization is comprised of internal IBIO employees and external security suppliers who provide security monitoring and response.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Under the oversight of our Executive Security Council, which is chaired by our Senior Vice President of Technology (Certified Information Systems Security Professional), and is also comprised of our Chief Legal Officer, Chief Operating Officer, Chief Accounting Officer and Treasurer and Chief Financial Officer, we have developed and implemented a cybersecurity risk management governance, risk, and compliance ("GRC") program that applies to us as well as our advisor and its affiliates. Our GRC program is used to identify, assess, and mitigate findings and risks to our operations from cybersecurity threats. Our GRC program employs qualitative and quantitative assessments of the cybersecurity risk landscape impacting our operations, as identified by our Information Technology ("IT") and Security team, to determine likelihood and potential impact. The analysis is evaluated by our Executive Security Council, and subject to the oversight of our board of directors to assess and prioritize potential risk to our information security. We consider cybersecurity, along with other top risks, within our enterprise risk management and GRC framework.

companyName: Cottonwood Communities, Inc.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. The CISO, who reports to our Chief Technology Officer, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO is an industry-recognized and credentialed executive with over a decade of leadership in information security, holding multiple professional certifications.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Providing input for internal and external auditors and independent third-party engagements, including in relation to internal and external (i.e., third-party operated) penetration tests. • Exercising risk oversight to conduct appropriate, risk-based due diligence and monitoring to understand risks associated with our third-party vendors and outsourced services.

companyName: BANNER CORP

ticker: BANR


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. Our cybersecurity risk management program is a key component of our overall risk management process, and includes similar characteristics, reporting channels and governance processes to those that apply across other legal, compliance, strategic, operational, and financial risk areas within the Company.

companyName: Nuvalent, Inc.

ticker: NUVL


text: Our Board has overall oversight responsibility with respect to the Company's approach to risk management, including cybersecurity risks. Although the Board has the ultimate responsibility for risk oversight, operational responsibility for cybersecurity matters is delegated to the Chief Information Officer (CIO) who oversees all technology needs of the Company, including the assessment and management of material risks from cybersecurity threats. The CIO has over thirty years experience in bank operations including network security and cybersecurity matters. The Bank employs a full-time Cybersecurity Analyst (CA) who brings over twenty-five years of information technology and network security experience to the role. In addition, we have various management- and Board-level committees that also oversee risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. Information security matters are a standing topic for the Management-only Technology Steering Committee (TSC) where membership includes the CIO, CA and other senior level managers, and the Management-Board level Enterprise Risk Management (ERM) Committee where membership includes the CIO, senior level managers, and a represent from the Board. Minutes from each ERM session are reported to the Audit Committee of the Board, and the CIO provides information security updates at each meeting of the Board.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: TDS identifies risks across the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. Risks related to third-party providers who have access to TDS data and systems are identified, assessed and managed through a formal third-party risk assessment process. Third-parties who access sensitive company or customer information are contractually obligated to meet specific privacy and security requirements. The TDS security operations program includes active monitoring of the internal data environment and regular assessment of the environments of third-party service providers who manage sensitive data. In addition, TDS security leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack and further test potential risks. Identified risks are evaluated against a risk classification framework to direct remediation, mitigation and management efforts based on severity. Cybersecurity risks are integrated into the TDS Enterprise Risk Management (ERM) program with updates provided on a quarterly basis.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: We recognize the critical importance of maintaining the trust and confidence of customers, contractors, commercial partners, vendors, consultants and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NexImmune, Inc.

ticker: NEXI


text: Significant incidents are escalated and communicated by senior IT management to the CIO to determine severity, cause and remediation. We also maintain a disaster recovery plan in which critical business systems, networks and data may be successfully recreated to minimize the financial impact of a cyber incident on our business. To strengthen resiliency against malware attacks, such as ransomware, we create immutable copies of all critical system data that is isolated from the rest of the network in case data recovery is required.

companyName: SUPERIOR ENERGY SERVICES INC


text: Both the board of directors and management have an active and ongoing role overseeing, assessing, identifying and managing material risks from cybersecurity threats.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: We plan to establish an appropriate confidentiality framework and adhere to relevant document management regulations. The Company and its employees are also required to sign confidentiality agreements for purposes including ensuring cybersecurity. As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: ABVC BIOPHARMA, INC.

ticker: ABVC


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The Company's Security Steering Committee is comprised of cross-functional executive management team members that collectively possess an extensive level of security and technology operations expertise. The mission of our Security Steering Committee is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies.

companyName: ULTRALIFE CORP

ticker: ULBI


text: The Company engages third parties on a regular basis to assess, test and assist with the implementation of our cybersecurity program to detect and manage cybersecurity risks, including but not limited to third parties who assist with monitoring our information security systems and auditors who assist with conducting penetration tests.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Our Vice President, Information Technology, in coordination with management, works to implement our program to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of our cybersecurity risk management program, we have assigned dedicated resources, including our Vice President, Information Technology, and members of his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management, the Audit Committee and the Board on a regular basis and as needed in response to specific incidents.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Identiv, Inc.

ticker: INVE


text: These three key elements of people, process, and technology are tightly interwoven to support our aim to secure our environments and the data for which we are a custodian.

companyName: PTC INC.

ticker: PTC


text: Cybersecurity is one of our most critical risks. For many activities important to our business, we depend on the confidentiality, integrity and availability of information systems and data, some of which are provided or managed by third parties. We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management.

companyName: GENESCO INC

ticker: GCO


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity."

companyName: indie Semiconductor, Inc.

ticker: INDI


text: Our Chief Financial Officer and Head of IT and Cybersecurity, a consultant, are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Head of IT and Cybersecurity have assistance from service providers, other consultants and third parties. Our Chief Financial Officer has served as an executive officer for over twenty-five years, including over fifteen years as an executive officer of public companies. Our Head of IT and Cybersecurity has served as an information technology professional for over eight years and has held senior IT positions at multiple companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: In support of our risk management program, we have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents. Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with us in any capacity. Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our commercial success depends on developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Array Technologies, Inc.

ticker: ARRY


text: As part of its risk management process, the Matthews management team also identifies, assesses and evaluates risks impacting the Company's operations, including those risks related to cybersecurity, and raises them for internal discussion, and where it is determined to be appropriate, issues are also raised to the Board of Directors for consideration.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: The cybersecurity risk management program is integrated into our broader enterprise risk management framework, which allows our senior management team, with oversight from our Board, to develop a more holistic view of our risk exposure and prioritize and manage such risks accordingly.

companyName: AUTOZONE INC

ticker: AZO


text: Both management and our Board understand that cybersecurity is crucial for securing our data and operations and defending the interests of our stakeholders. Our Board considers cybersecurity risk management as part of its general oversight function and receives an annual update on cybersecurity matters. The audit committee of our Board oversees management's process for identifying and mitigating cybersecurity threats and implementing the cybersecurity risk management processes described above. On a quarterly basis, our Vice President and Chief Information Officer ("CIO") and CISO update the audit committee regarding cybersecurity management initiatives, the status of ongoing cybersecurity threats CMC faces and other developments regarding our cybersecurity management protocols.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: Third parties also play a role in the Company's approach to cybersecurity and its associated risk management framework. HighPeak Energy leverages technological tools and partners with the goal of augmenting and enabling the efforts of its internal cybersecurity team. Separately, our internal auditing processes include processes to identify, manage and oversee the risks from cybersecurity threats associated with our engagement of third-party service providers. In connection with and pursuant to the IRP, our incident response team, made up of management, employees and third-party cybersecurity personnel, works collaboratively across HighPeak Energy to carry out a program that has been designed to protect our information systems from cybersecurity threats, assess and manage risks arising from any such threats, and to respond to potential cybersecurity incidents.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: The ISO is responsible for reporting, at least annually, to the Board of Directors on the status of the ISP, including overall compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP. The Board also receives quarterly cybersecurity briefings that include updates on emerging threats, results of cybersecurity risk assessments, and the effectiveness of current controls. These discussions inform strategic decision-making and resource allocation for cybersecurity investments.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: The underlying controls of the Company's cybersecurity program are designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") standards for cybersecurity and information technology. The controls in the Company's cybersecurity program include but are not limited to, endpoint threat detection and response, privileged access management, logging and monitoring, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability, and patch management. Management regularly assesses the Company's cybersecurity capabilities and has implemented policies, processes, and technology that it considers appropriate to reduce the likelihood or impact of a breach.

companyName: Andersons, Inc.

ticker: ANDE


text: CRH also maintains a Company-wide incident response function centered in our Group Information Security (GIS) team, led by the CISO. GIS responds to potential incidents across CRH in accordance with predetermined severity classifications. In line with CRH's Cybersecurity Incident Escalation Standard and supporting guidelines and procedural documentation, incidents that are deemed potentially material to the Company and/or which may lead to the exposure of confidential or sensitive data are immediately escalated to GIS for review and, as necessary, mitigation and remediation actions are taken. GIS and the CISO also review regular attestation reports that are required to be prepared by CRH's operating subsidiaries and business units regarding cybersecurity incidents that did not meet the threshold for immediate escalation.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Our information security team is led by the SVP of IS, who reports to our chief financial officer. Our SVP of IS has over 25 years of experience managing and securing technology infrastructure. The information security team has responsibility for the planning and execution of our processes to manage cybersecurity and other information technology risks. The information security team also institutes and maintains controls for our systems, applications, and databases.

companyName: Blueprint Medicines Corp


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as advanced degrees in business administration and legal studies, industry certifications focused on financial services and information technology, including information security, as well as extensive industry experience. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: Audax Credit BDC Inc.


text: Managing Third Party Risk BKV's cybersecurity approach also assesses the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures as well. BKV also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards, and regularly updates and patches third-party applications and tools when vulnerabilities are discovered.

companyName: BKV Corp

ticker: BKV


text: The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity standards, processes and practices, which are integrated into the Company's overall risk management processes. To protect the Company's information systems from cybersecurity threats, including those related to third-party service providers, the Company uses various security tools, such as third party vendors that help the Company identify, escalate, investigate, resolve and recover from security incidents in a timely manner. The Company's cybersecurity procedures and standards are reviewed and overseen by the Company's cybersecurity group.

companyName: New Fortress Energy Inc.

ticker: NFE


text: There have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this Annual Report, including "Our internal computer systems or those of our development collaborators, third-party CDMOs, or other contractors or consultants may fail or suffer cybersecurity incidents, data breaches, or other disruptions, which could result in a material disruption of our product development programs and cause our business and operations to suffer," for additional discussion about cybersecurity-related risks.

companyName: Ocugen, Inc.

ticker: OCGN


text: In addition, the Information Systems (IS) Steering Committee, which is chaired by the Company's Chief Information Officer, serves as an advisory group providing assistance and guidance to management regarding customer information security, information systems planning, systems management organization, systems performance, business continuity, information security, system related expenditures, vendor management, and related policies and procedures. The IS Steering Committee meets on a monthly basis. Formal meeting minutes serve to document decisions and recommendations by the IS Steering Committee and are reported to both the Management Risk Committee and the Board ERM Committee. Management has appointed the Chief Information Officer the responsibility for overall management of the Company's "front line" IT risk.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: Depending on the nature and severity of an incident, this process provides for evaluation by an executive management group to determine if the incident is material to us by evaluating the impact on our financial condition, reputation and potential litigation risk and regulatory impact. The management group is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Accounting Officer and the SVP IT to determine if escalation is necessary by the Chief Executive Officer to the Board (specifically our Lead Independent Director and the Audit Committee Chair).

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: At the management level, our cybersecurity program is led by our CDTO and our CISO. Our CDTO has served in various information technology roles for over 26 years, including as Chief Digital and Technology Officer of Kimberly-Clark and as Executive Vice President and Chief Digital Officer of Toyota Motors North America, Inc. Our CISO has served as a chief information security officer or equivalent role at large public and private companies for over 16 years. Our CISO also has several information technology-related certifications, including the Certified Information Systems Security Professional ("CISSP") certification. Our CISO reports to our CDTO, who in turn regularly reports to our Chairman of the Board and Chief Executive Officer. We have protocols by which certain cybersecurity incidents are reported promptly to the Chairman of the Board and Chief Executive Officer, or the Audit Committee, as appropriate.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to the Company, our customers, suppliers, or dealers, or other key stakeholders.

companyName: Fisker Inc./DE


text: Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors encourages management to promote a culture that incorporates risk management into our corporate strategy and day-to-day business operations. Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: Management Oversight In January 2024, the Company established a Cybersecurity and Technology Risk Committee (the "Cybersecurity Risk Committee"), comprised of our CTO and senior managers from across the Company. The Cybersecurity Risk Committee has responsibilities that include managing, monitoring and coordinating the Company's cybersecurity and technology risk management and any required remedial or corrective actions; reviewing the effectiveness of the ISP and serving as the primary escalation point for cybersecurity matters under the ISP.

companyName: PJT Partners Inc.

ticker: PJT


text: Key Internal Governance Bodies Xylem has a number of committees to bolster business resilience, protect shareholder value and enable compliance with regulatory requirements. The Enterprise Risk Committee ("ERC"), a key component of the Company's ERM Program, is comprised of senior executives and is responsible for reviewing the Company's key risks as identified by the ERM Program, including cybersecurity, and overseeing the Company's identification, assessment, management, mitigation and ongoing monitoring of these risks. As such, the ERC periodically receives reports from the CISO on cybersecurity risk.

companyName: Xylem Inc.

ticker: XYL


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the reporting period covered by this report. However, institutions like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect us, see "Part 1. Item 1A. Risk Factors—Risks Related to Our Business—Cyber-security failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments" in this Annual Report on Form 10-K.

companyName: KKR & Co. Inc.

ticker: KKR


text: The Information Security Team leverages a variety of processes and controls to stay informed of and manage cybersecurity risk. It partners with a variety of business units, including our engineering, legal, privacy, compliance, internal audit, technology, and product teams to identify and control emerging risks. The Information Security and privacy teams also from time to time engage consultants and other third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes. The Information Security Team additionally has adopted security control principles based on ISO 27002:2022 and partners with counterparts in our legal department to use various formalized incident management and monitoring standards and incident response plans and playbooks, which define immediate steps in the event of a cybersecurity incident, roles and responsibilities, as well as materiality criteria to allow for efficient and effective incident management. This includes a third-party vendor management procedure, under which we conduct vendor risk assessments and, when appropriate, ongoing threat monitoring. In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.

companyName: CARVANA CO.

ticker: CVNA


text: Cyber Risk Oversight Committee Additionally, in 2014 the board of directors established CyROC to provide executive management and the audit committee of the board of directors with analyses, appraisals, recommendations and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies and oversight of cybersecurity risks. The CyROC is chaired by the Company's CIO and is comprised of members such as the chief financial officer, information technology leaders, internal auditors, and other leaders from across the Company.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Our Chief Information Security Officer ("CISO") oversees a global information security team which is responsible for protecting the information and operations of us and our clients. Our current CISO has over 24 years of experience and leadership in the cybersecurity industry, holds a master's degree in Information Security and Assurance, and has received numerous industry certifications, including ISO-27000 Specialist, EC-Council Disaster Recovery Professional and an ISACA certification in Risk and Information Systems Control, among others. The information security team has established a security operations center and other partnerships with service providers to monitor for technology and security incidents which are actioned based on the Company's incident response procedures.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: Understanding the risks posed by external partners, we have strengthened our third-party risk management program. This initiative focuses on evaluating and monitoring the cybersecurity practices of our vendors, service providers, and business partners to mitigate potential supply chain risks. Additionally, our incident response plan has been enhanced to support swift detection, containment, and remediation of cybersecurity incidents, ensuring operational continuity and minimal disruption with the addition of an incident response retainer.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Our board of directors has overall oversight responsibility for our risk management, and delegates data protection and cybersecurity risk oversight to the audit committee. The audit committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The audit committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The audit committee periodically discusses our approach to cybersecurity risk management with our VP of Technology & Senior Security Officer.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: We use third-party service providers to perform a variety of functions throughout our business, including manufacturing our product candidates and assisting with R&D activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: Annual risk assessments and penetration testing are performed by independent third party consultants. These tests are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. The results of these tests are presented annually to the Board of Directors ("Board"), Audit Committee, and senior management for review to ensure compliance with cybersecurity standards.

companyName: ENNIS, INC.

ticker: EBF


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders, including a member of the Board meet at least monthly to develop strategies for preserving the confidentiality, integrity and availability of our company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: Additionally, we engage in cyber crisis response simulations to assess our ability to adapt to information and operational technology threats. Improper or illegitimate use of our information system resources or violation of our information security policies and procedures is subject to disciplinary action. Our security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication to ensure that access to information and communication is vetted and secure.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: We do not believe risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to the risk factor titled "Failure to protect our information technology infrastructure against cyberattacks, security breaches, service interruptions, or data corruption could materially disrupt our operations and adversely affect our business and operating results", included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, for additional information about risks related to cybersecurity matters.

companyName: Inari Medical, Inc.


text: The day-to-day management of the Company's cybersecurity framework is managed by the Company's information technology team while operational oversight of its design and function are managed by the Company's management team including, but not limited to, its Chief Operating Officer (COO), Chief Financial Officer (CFO), Vice President Implementation and Launch, and Director of Information Technology, all of whom have substantial experience managing enterprise risk, including cybersecurity risks. Our management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our incident response procedures.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: The scale, scope, and complexity of our business raises a multitude of interdependent risks, which can vary over time. A primary responsibility of our Executive Leadership Team ("ELT"), subject to oversight by our Board of Directors and specifically, our Audit Committee, is to design and implement rigorous processes to identify, prioritize, assess monitor, and manage enterprise-level risks, including any material risks associated with cybersecurity threats. Our Enterprise Risk Management ("ERM") team directly oversees the ERM process which incorporates input from personnel from different functions, levels, and operating regions (collectively, the "cross functional team") to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. Our Chief Financial Officer leads and oversees the ERM team with input from other ELT members and the cross-functional team. The ERM team meets at least quarterly to discuss key risks and to discuss mitigation strategies. The results of our ERM process are communicated to the Board at least annually.

companyName: SOUTHWESTERN ENERGY CO


text: The CAO and Chief Financial Officer are members of both the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee and are supported by our information security, compliance, contracts, treasury, investor relations, operations, and supply chain organizations so that identified issues can be addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: TRIUMPH GROUP INC


text: UHS also has a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain, eradicate, and restore systems in the event of a major disruption. Regularly, UHS conducts tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve recovery practices. As part of these processes, UHS regularly engages with assessors, consultants, auditors, and other third parties to review UHS' cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: We design and assess our program based on the National Institute of Standards ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Shake Shack Inc.

ticker: SHAK


text: The Company manages its data protection and privacy program, fostering collaboration with partners across business units and functional areas to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate and manage such risks. Third parties are engaged to assess the Company's cybersecurity posture and adherence to the NIST Cybersecurity Framework and CIS Controls, and the Company evaluates cybersecurity risks as part of its annual risk assessment process. Cybersecurity risk mitigation strategies and initiatives are developed based on these assessments.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive AMG data. We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data (including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: Our cybersecurity risk management extends to risks associated with our use of third-party service and technology providers as well as partnerships with third parties we may enter into. For instance, we conduct risk and compliance assessments of third parties that request access to our IT resources and information or who provide technology products to Charles River.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Program and Strategy Our cybersecurity risk management program (the "Cybersecurity Risk Management Program") was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material. The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Innospec's Board has delegated responsibility for the management of the Company's IT to the Company's IT steering committee via the CEO and CFO. The IT steering committee is made up of executive management, business leaders from our reporting segments, the functional heads responsible for our operating systems, IT leadership and is chaired by our Global IT Director. The Company considers that the IT steering committee members have the appropriate qualifications and experience required to enable them to fulfill their responsibilities. The IT steering committee may, as per its agreed terms of reference, escalate any matter it wishes to the Board via either the CEO or CFO.

companyName: INNOSPEC INC.

ticker: IOSP


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns (including data privacy risk management) and the steps management has taken to monitor and control such exposures with management.

companyName: CRAWFORD UNITED Corp


text: The Company's information risk management program is designed to protect the confidentiality of nonpublic, sensitive information and the integrity and availability of our information systems. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. We have designed our enterprise-wide information security program consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: Identifying and assessing cybersecurity risk as well as protecting us from such risk is integrated into our overall risk management systems and processes as well as specifically addressed in our enterprise-wide cybersecurity program. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including threat intelligence collaboration and advisory mediums, third-party due diligence and risk assessments when determining the selection, oversight and engagement of third-party service providers, application security evaluations and annual penetration tests as well as management risk and compliance reviews. The foregoing combines with periodic review and analysis of third-party service provider system and organizational controls, internal network intrusion prevention systems, vulnerability assessments, access management, data loss prevention, remote access control, mandatory cybersecurity awareness training and random phishing campaigns with additional requisite training, if applicable, to identify and protect against cybersecurity risk.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: The cyber risk management program is overseen by our CIO, who has over 20 years of experience in leading all aspects of IT. This is done in coordination with our Vice President, IT Audit and Security, who has over 25 years of experience in cybersecurity and other IT security roles, including the management of cybersecurity and compliance teams.

companyName: Excelerate Energy, Inc.

ticker: EE


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. The Audit Committee regularly receives an overview of our cybersecurity activities from management. Material cybersecurity threat risks may also be considered during separate Board discussions of important matters such as enterprise risk management, budgeting, and other relevant matters.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Operations in Emerging Markets The Company has its material properties and operating subsidiaries in Botswana. It is possible that operating in Botswana may expose the Company to a certain degree of political, economic and other risks and uncertainties. In conducting its operations in Botswana, the Company has, among other things: (i) engaged and maintained experienced management and technical teams located in Botswana and/or with extensive experience in operating properties in Africa; (ii) certain members of the board and management routinely visit the Company's Botswana properties; (iii) retained advisors and technical experts in Botswana including its local counsel, Bookbinder Business Law (" Bookbinder "); and (iv) generally maintained robust internal control over its foreign subsidiaries, all of which are more particularly described below.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Our cybersecurity and information security programs are designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. The program includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect and respond to cybersecurity threats and incidents, we undertake the below listed activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake regular reviews (at least annually) of our consumer facing and internal policies and statements related to cybersecurity; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual information security training for all employees; • recruit and retain highly skilled cybersecurity professionals, and provide regular training and development opportunities for our cybersecurity and information security employees; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • perform due diligence on third-party vendors and, based on our risk assessment, put in place contractual undertakings and oversight to manage and reduce the risks associated with third-party vendors; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our technologies, methods and processes; • conduct regular risk assessments of our information systems to identify weaknesses, and develop and implement mitigations to improve our cybersecurity and information security program; • conduct regular security assessments, vulnerability scans, and penetration tests (including by third-party assessment firms) of products systems and internal systems to discover vulnerabilities and apply appropriate mitigations within standardized timelines; • maintain, implement, evaluate and update our cybersecurity technologies to address threats and vulnerabilities; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Company's Cyber Security Committee, and when appropriate, the Audit Committee, and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices at least annually, or more frequently as necessary, based on the information provided by the assessments, audits, and reviews.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: The CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide for to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: CNH Industrial N.V.

ticker: CNH


text: We maintain 24/7 cybersecurity threat operations in order to rapidly detect, contain and respond to cybersecurity threats and incidents.

companyName: CEVA INC

ticker: CEVA


text: The Company relies on information systems and the data stored on them to conduct its operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.

companyName: Lifeward Ltd.

ticker: LFWD


text: We conduct an annual tabletop exercise facilitated by an external cybersecurity specialist. This exercise simulates various attack scenarios, testing our incident response plans and procedures to ensure effective threat detection, mitigation and remediation. It also evaluates potential business impacts, including business continuity, backup strategies, data protection, compliance, and regulatory requirements such as GDPR, CCPA and PCI. Participants include IT leadership, finance, legal, insurance, and operations teams across all subsidiaries, ensuring a coordinated and well-prepared response to cybersecurity threats.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Our management team supervises efforts to identify, protect, detect, respond and recover cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Oncternal Therapeutics, Inc.


text: There are a number of state and federal laws and regulations that govern financial privacy and cybersecurity. At the federal level, this includes the privacy protection provisions of the Graham Leach Bliley Act ("GLBA") and related regulations, including Regulation P, which govern the treatment of nonpublic personal information. Under these privacy protection provisions, we are limited in our ability to disclose non-public information about consumers to nonaffiliated third parties. These limitations require disclosure of privacy policies and notices to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. Consumers also must be notified in the event of a data breach under applicable state laws. On April 1, 2022, a final rule issued by federal financial regulatory agencies became effective – that rule imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" as those terms are defined in the rule. Banks' service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

companyName: CapStar Financial Holdings, Inc.


text: The utility industry has been the target of several cyberattacks on operational systems and has seen an increased volume and sophistication of cybersecurity incidents from international activist organizations, other nation state actors and individuals. We expect to continue to experience attempts to compromise our information technology and control systems, network infrastructure and other assets. To date, we have not experienced a cybersecurity incident that has had a material impact on our business or results of operations.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company relies on the Investment Advisor to implement the cybersecurity program. The cyber risk management program involves risk assessments relating to the information systems of the Investment Advisor, incident response training and testing, implementation of security measures, and ongoing monitoring of systems and networks and assessment of the associated risks on an annual basis, including networks on which the Company relies on. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Investment Advisor has engaged external experts, including consultants, to evaluate cybersecurity measures and risk management processes. The Company depends on and engages various third parties, including suppliers, vendors, and service providers. The compliance team of the Company and the Investment Advisor will conduct onboarding and ongoing due diligence of each third-party engaged by them, including identify and oversee risks from cybersecurity threats associated with their use of such entities.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: We also employ the use of Secure Socket Layer inspection on our firewalls, which are able to decrypt and scan all network traffic entering and leaving our facilities. We regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, including regularly reviewing and updating our incident response plan.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: The Cybersecurity Program is supervised by Roper's Vice President of Cybersecurity, who has related experience including cybersecurity, IT, Cloud, and Security Compliance. The Vice President of Cybersecurity has obtained a B.S. in Management Information Systems, a Master's in Business Administration, and a Master's in Management Information Systems. She also maintains the following industry cybersecurity certifications: CISA, CISSP, GSEC, GCED, GSA, and a Boardroom Certified Qualified Technology Expert (QTE).

companyName: ROPER TECHNOLOGIES INC

ticker: ROP