text: We have retained a seasoned virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: Through ongoing communications with these teams, our Vice President, IT, and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the audit committee on a quarterly basis and as otherwise necessary, and annually to the full Board and as the cybersecurity committee otherwise deems appropriate. Our Vice President, IT has over 20 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing data centers, designing networks and infrastructure. Our Vice President of IT oversees a team of experienced and certified individuals who holds various certificates relevant to information security.

companyName: Inari Medical, Inc.

secItem: Item 1C


text: Reporting to Board of Directors The CISO provides management, the Technology Committee and the Board of Directors with information regarding the Company's cybersecurity program and potential cybersecurity threats or incidents. In addition, the CISO is empowered to escalate material cybersecurity threats or incidents and strategic risk management decisions to the Board of Directors so that they can provide appropriate oversight and guidance on these critical cybersecurity issues within the context of the Company's overall strategic objectives and business operations. Management, the CDO, the CRO, and the Incident Management Team (the "IMT") are also required to report cybersecurity threats and incidents to the Technology Committee and/or the Board of Directors, as applicable.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Our CISO, along with the STRC, are responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years' experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.

companyName: TransUnion

ticker: TRU


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer, or CSO, and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related data (collectively "Information Systems and Data").

companyName: MANNKIND CORP

ticker: MNKD


text: Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: Cybersecurity Awareness Training: Employees, incident response teams, and senior management undergo regular training to ensure awareness of evolving cybersecurity threats and the appropriate responses.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk mapping and management documentation. The cybersecurity component of the Company's risk mapping and management documentation is updated annually, and our Information Systems function, led by our Vice President for Information Systems and Director of Information Systems, prepares cybersecurity roadmaps designed to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: DBV Technologies S.A.

ticker: DBVT


text: With regard to personal information protection regulations and cybersecurity-related laws and regulations in various countries, in addition to current regulations, Honda collects and monitors information on regulatory trends that are expected to be enforced in the future. Data security incident response plans have been established at AHFC and HCFI that guides the analytical processes, response phases, and procedures to follow during a data security incident of personally identifiable information.

companyName: AMERICAN HONDA FINANCE CORP


text: Our Computer Systems Operations Manager is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.

companyName: Fifth District Bancorp, Inc.

ticker: FDSB


text: Our cybersecurity program is managed by a dedicated Global Chief Information Officer whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Global Chief Information Officer has over 35 years of relevant industry experience, including over 29 years at our Company. Our Senior Director of Information Security functions as our Chief Information Security Officer and has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and senior management receive periodic briefings from the Global Chief Information Officer and the Senior Director of Information Security, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: As discussed further in "Item 1. Business—Our Manager and Ellington," we are externally managed and advised by our Manager, an affiliate of Ellington. Our Manager does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. Other than with respect to our majority-owned subsidiary Longbridge's operations, we rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Ellington Financial Inc.

ticker: EFC


text: As part of our cybersecurity defense strategy, we employ tools and systems safeguards intended to help secure our networks, applications, data and infrastructure, and to manage cybersecurity vulnerabilities. These safeguards include network and perimeter defense, infrastructure security, endpoint protection, data protection, identity management and network segmentation. We work to evaluate and improve on these tools and safeguards through periodic cybersecurity assessments and the integration of cybersecurity threat intelligence.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We use the results of the above-described tools and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity threats, to enhance such safeguards, or implement new safeguards, as necessary. We have several safeguards in place to manage material risks from cybersecurity threats. We have security awareness training for our employees, including ongoing simulated phishing email campaigns.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: Cybersecurity risk oversight is a focus area of our Risk Management Committee and the full Board of Directors. The Risk Management Committee's charter requires it to assist the Board of Directors in identifying and evaluating risks inherent in our business and to oversee and review the significant policies, procedures, and practices employed to manage risks. The Risk Management Committee receives a quarterly cybersecurity update from the Chief Administrative Officer (CAO), which is shared with the full Board of Directors. The Board of Directors discusses cybersecurity matters and risks on a quarterly basis or more frequently, as needed, at the recommendation of the Risk Management Committee.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Our Audit Committee receives reports from the CTO on our cybersecurity risks. In addition, the CTO updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: We depend on IT systems, third-party service providers, and strategic partners to facilitate our business operations. This includes secure handling of personal, confidential, financial, sensitive, proprietary, and other forms of information, as well as enabling our service offerings. Despite continuous efforts to enhance both our and our partners' cybersecurity defenses, we cannot guarantee the protection of all information systems, products, and service technologies.

companyName: J M SMUCKER Co

ticker: SJM


text: Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated with use of third-party vendors and exercise appropriate due diligence before entering into a vendor arrangement. We also engage a third-party to actively monitor our cybersecurity risks and gather threat intelligence of select vendors and their products and services. Additionally, we conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Our contracts governing third party engagements require certain security and privacy protections where applicable. All third parties with access to our information systems must review and acknowledge our Acceptable Use Policy before access is granted.

companyName: S&T BANCORP INC

ticker: STBA


text: 2. Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We also engage security vendors with credentialed security professionals to bolster our cybersecurity risk management, security event monitoring and detection, and incident and crisis response capability.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Company has implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and its critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient data ("Information Systems and Data").

companyName: TerrAscend Corp.

ticker: TSNDF


text: The audit committee will receive periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: Mr. Hernandez is responsible for hiring appropriate personnel, helping to develop the Company's cybersecurity risk management strategy and communicating key priorities to relevant personnel. Mr. Hernandez is also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Mr. Young is responsible for approving cybersecurity-related budgets.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: The Company employs a tiered structure of management and oversight for cybersecurity, characterized by distinct layers of responsibility and decision making, which includes operation staff, management, and senior management and board-level governance. As discussed in more detail below under "Cybersecurity Governance", this involves management responsibility through a specialized Cyber Risk Committee (the "CRC") and oversight of that committee by a group of the most senior leaders of the Company, which comprise the Company's Executive Committee. At the Company's Board of Directors (the "Board") level, the Audit Committee oversees our cybersecurity risk management program.

companyName: REGENCY CENTERS LP


text: Our Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; and (4) Post-Incident Activity.

companyName: BTC Digital Ltd.

ticker: BTCT


text: Board and Committee Oversight Although our full Board of Directors is ultimately responsible for risk oversight, our Board is assisted in discharging its risk oversight responsibility by its committees. The Audit and Finance Committee of the Board is responsible for providing oversight of our information security program and cybersecurity risks. In connection with this oversight role, the Audit and Finance Committee receives information technology updates from management at least quarterly. Cybersecurity risks facing the Company and updates on the Company's practices and progress to mitigate such risks are also the subject of management reports to the Audit and Finance Committee on a more frequent basis, as necessary or appropriate.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: As a global aerospace and defense company serving commercial and government customers in the aerospace industry and domestic and international military and government customers as a defense contractor, we are the target of advanced and persistent cyber-attacks from a variety of sources. Our products and services are highly sophisticated and specialized, involve complex advanced technologies including information technology (IT) systems, and process, store, or transmit highly sensitive unclassified and classified information. Moreover, our products and services are often integrated with third-party products and services. Cybersecurity threats include attacks on, or other attempts to infiltrate, our IT infrastructure and the IT infrastructure of our customers, suppliers, subcontractors, and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, such as attacks targeting the security, confidentiality, integrity or availability of the hardware, software and information installed, stored, or transmitted in our products, which may occur after the purchase of those products or when they are incorporated into third-party products, facilities, or infrastructure.

companyName: RTX Corp

ticker: RTX


text: Southwest Gas' processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to customer and employee data or our systems. Third-party risks are included within our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through our diligence review. Our due diligence process involves the use of questionnaires that are completed by third-party service providers and reviewed by business representatives and cybersecurity specialists to identify risks associated with third-party service providers. We use the responses provided to assist in finding ways to mitigate risks presented by a particular third-party service provider, consistent with the services provided. Additionally, contracts with third parties that could introduce significant cybersecurity risk to Southwest Gas include terms to assist in the mitigation of cybersecurity risks, including but not limited to, requiring counterparties to report data privacy or cybersecurity incidents to us and to agree to be subject to periodic cybersecurity audits as appropriate.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: We experience cybersecurity threats and incidents from time to time. We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, our financial condition, results of operations or cash flows. There can be no assurance that cybersecurity threats will not have a material effect on us, including our business strategy, our financial condition, results of operations or cash flows. Please see "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: KROGER CO

ticker: KR


text: The Company's Chief Information Security Officer (CISO), in coordination with Chief Information Officer, is responsible for leading the assessment and management of cybersecurity risks and receives reports regarding the prevention, detection, mitigation and remediation of cybersecurity incidents from the Company's cybersecurity operations team. The current CISO has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP). The CISO reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly or as needed basis.

companyName: Veralto Corp

ticker: VLTO


text: The Board of Directors, along with its Audit Committee, oversees the management of cybersecurity risks, and receives quarterly reports from management on the detection and remediation of cybersecurity incidents, as well as on material security risks and vulnerabilities. Through our outsourced managed service provider, we are informed about, and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of, and participation in the monitoring systems and processes described above. The information about such incidents is reported to the Company's Chief Executive Officer and Chief Financial Officer, who then would report such information to the Company's Board of Directors, in some cases, earlier than the regular quarterly reports depending on the nature and severity of the incident.

companyName: Motorsport Games Inc.

ticker: MSGM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk-management program includes a cybersecurity incident response plan.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: We have developed and implemented a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our vendors, CROs, suppliers and/or manufacturers who may have access to patient and employee data or our systems. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct continuously through third-party risk management tools.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Twin Vee PowerCats, Co.

ticker: VEEE


text: We are also committed to strong third party risk management. Our Third Party Program provides guidance for managing third party risk and is designed to assist us with the identification, measurement, management, monitoring and reporting of third party risk.

companyName: Discover Financial Services


text: Cyber Risk Governance The Audit and Risk Committee is responsible for assisting the Board with oversight of our enterprise risk framework, including cybersecurity, information security, information technology and business continuity and resiliency. Our CISO and other members of senior management including our General Counsel, CCO and CRO report quarterly to the Audit and Risk Committee at its regular meetings on the status of the Company's cybersecurity risk, risk management policies and risk assessment initiatives. The full Board is updated on an as needed basis. In addition, management updates the Audit and Risk Committee, as appropriate, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: We do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected us. However, the sophistication of cyber threats continues to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Management and Strategy have established information security practices to provide effective security controls to protect the privacy and confidentiality of our information. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes.

companyName: Harbor Custom Development, Inc.


text: The board of directors receives periodic reports from management and its designees concerning our significant cybersecurity threats and risks, and the processes we have implemented in an effort to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Walter Geldenhuys, president and chief executive officer, is the Company's sole director. Mr. Geldenhuys is committed to effective governance in managing risks associated with cybersecurity threats because he recognizes the significance of these threats to the Company's operational integrity and stakeholder confidence.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: In addition, the Company has established a Security Incident Response Team ("SIRT") led by the CSO and consisting of (i) Chief Executive Officer, (ii) Chief Product Officer, (iii) Chief Financial Officer, (iv) President, Chief Operating Officer, and (v) Chief Legal Officer/ General Counsel and others. When any defined incident occurs, the SIRT convenes to drive a remediation plan based on its security incidence response escalation process designed to contain potential incidents, investigate the root causes and corrective action required, notify relevant stakeholders and determine reporting requirements.

companyName: Upland Software, Inc.

ticker: UPLD


text: We are exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third-party service providers. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the two-year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory scrutiny or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations. We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), and harm to customer or third-party relationships or the possibility of litigation or regulatory investigation or actions that could materially adversely affect our results of operations and our reputation. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: The Company's Chief Financial Officer and Treasurer, Chief Legal Officer and Secretary, and Head of IT work collaboratively with other employees of our Manager and the MSSP to ensure the MSSP's services protect the Company's Information Systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. These members of the Company's management team, together with the MSSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit and Valuation Committee when appropriate. These members of the Company's management team meet periodically to assess cybersecurity risks and discuss with the Audit and Valuation Committee. They have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: Our CTO has extensive experience designing, developing, and utilizing technology products for security operation center services. His technical responsibilities spanned product security, privacy controls, data protection, and identity management. He has also overseen security operations, incident response, threat hunting, security intelligence, analytics, and technical fraud functions and worked with legal response teams at numerous companies, including serving as a Managing Director of a cybersecurity firm. He has advised chief information officers and consulted for boards of directors on cybersecurity related issues and attacks.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: The Company's Board of Directors, directly and through its committees, is responsible for overseeing cybersecurity risks that affect the Company. As such, the Board has delegated oversight of risks related to cybersecurity to the Audit Review Committee of the Board of Directors (the "ARC"). The ARC is charged with reviewing the Company's cybersecurity risks, controls and procedures. The ARC reviews the Company's plans to mitigate cybersecurity risks and the Company's ability to respond to and remediate cybersecurity incidents. The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.

companyName: HYSTER-YALE, INC.

ticker: HY


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we endeavor to undertake the below listed activities: Monitor emerging data protection laws in conjunction with our advisors and implement changes to our processes to comply;

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: We have implemented and maintain multiple layers of physical, administrative and technical security processes designed to protect our manufacturing facilities from disruptions that may result from cybersecurity incidents, as well as safeguard the confidentiality of our critical systems, and data residing on those systems, including employee data, customer data and intellectual property. Our risk assessment and management of material risks from cybersecurity threats is integrated into our overall enterprise risk management process, as well as our information systems processes. Our strategy includes regular formal risk assessments, dynamic risk and threat analysis, utilization of security tools, regular cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and frequent security awareness and technical security trainings. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response program, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities. We also have an internal employee network of hundreds of security awareness ambassadors from diverse functions throughout our global locations who inform our personnel concerning threat awareness and cybersecurity risk mitigation.

companyName: LEAR CORP

ticker: LEA


text: If a cybersecurity incident were to occur, we would utilize our incident response plan. This plan governs our process of assessing the incident and our internal and external communications strategy. Our response would be led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, we may escalate notification to our board of directors.

companyName: Excelerate Energy, Inc.

ticker: EE


text: We face a number of cybersecurity risks in connection with our business. Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We may also rely on information technology and third-party vendors to support our operations, including to collect and store sensitive data. Despite ongoing efforts to continued improvement of our ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.

companyName: ELUTIA INC.

ticker: ELUT


text: All environments are isolated using credentials and accounts are following a plan to ensure scheduled patching, upgrades, and other maintenance occur every quarter. This includes updates for have the capability to search our logs for security incidents are on schedule to monitor every public endpoint using a Web Application Firewall (WAF), ensuring that all traffic is logged with patterns to detect any suspicious behavior aim to enable automatic processes to ensure no production data is changed without systematic audits data visualization tool has login credentials with role-based access Management's Role: Our board of directors has ultimate oversight of cybersecurity risk. Our VP of Engineering and Platform Engineering Manager lead cybersecurity risk assessment and management efforts, collaborating closely with the interim CEO for guidance, strategic direction, alignment with business objectives, and environment.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: We have not identified any cybersecurity incidents that have materially affected Axos or its business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks which may materially affect the Company in the future. Refer to the Risk Factors section for additional information.

companyName: Axos Financial, Inc.

ticker: AX


text: The Board has overall responsibility for the oversight of risk management for the Company, and it exercises this oversight through Board committees and regular engagement with the Company's senior management. The Audit Committee is responsible for oversight of cybersecurity risk exposure and mitigation, and receives regular updates on cybersecurity risk management as well as timely notice of any material cybersecurity developments from the CISO through our escalation processes. The CISO presents quarterly or as needed at the Audit Committee meetings on the Company's cybersecurity risk management activities.

companyName: TRIMBLE INC.

ticker: TRMB


text: As of September 30, 2024, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: CEMTREX INC

ticker: CETX


text: Our platform is designed to help ensure the security of our data and systems, protect our customers' personal information, and meet the rigorous privacy and security requirements of our Enterprise clients. To that end, we have obtained, and we maintain through regular audits where relevant, the following security and privacy certifications: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, and U.S.-EU and U.S.-Swiss Privacy Shield certifications. We are also TrustArc certified. In addition, we leverage the National Institute of Standards and Technology security framework to drive strategic direction and maturity improvement to protect against new and evolving cybersecurity risks over time.

companyName: UPWORK, INC

ticker: UPWK


text: The Company recognizes the critical importance of assessing, identifying and managing material risks associated with cybersecurity threats, as well as developing, implementing and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We focus significant resources on protecting our technology infrastructure and the personal information therein regarding applicants, our students, their families, our alumni and our employees. Our principal cybersecurity risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: Our cybersecurity risk management program is designed to be integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: The Company is committed to maintaining a strong cybersecurity posture devoting significant resources to cybersecurity and risk management processes to adapt to the rapidly evolving landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company has designed and implemented cybersecurity policies and procedures for identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular basis. At the tactical level, our information technology (IT) security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The Company monitors and evaluates our cybersecurity position and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Additionally, the Company maintains a formal information security training program for all employees that includes training on matters such as phishing, email security best practices and data privacy. To evaluate and enhance our cybersecurity program, it is regularly evaluated by external experts with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: We have experienced in the past, and we expect to continue to experience, cybersecurity threats and events of varying degrees. However, we are not aware of any of these threats or events having a material impact on our business or our business strategy, results of operations or financial condition results to date. We cannot assure you that we will not experience future threats or events that may be material. Please also refer to the risk factors above for additional information.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: Cybersecurity remains a critical component of corporate governance at the Company. The Company's MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company's policies and procedures are functioning as designed to protect the Company's information systems from potential cybersecurity threats. Management is provided regular updates on the Company's cybersecurity programs, training metrics, system health status and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would be notified immediately of any cybersecurity incidents.

companyName: KOSS CORP

ticker: KOSS


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner designed to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit and Finance Committee of the Board, or the Audit and Finance Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: CareDx, Inc.

ticker: CDNA


text: Management Oversight Primary responsibility for the oversight of the assessment, identification and management of our cybersecurity risks rests with our Senior Vice President, Information Technology. Under her direction, these risk mitigation efforts are designed, tested, and implemented by our Senior Director, Information Security. Collectively, the Cybersecurity Leadership Team has over 50 years of experience in the field of Information Technology, holding relevant academic degrees and industry certifications, including the Certified Cloud Security Professional and Certified Information Systems Security Professional designations. The Cybersecurity Leadership Team oversees our information technology governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.

companyName: CubeSmart

ticker: CUBE


text: We evaluate all of our vendors and third-party partners for material cybersecurity risks and take steps to mitigate risk through insurance and contractual risk transfer provisions when appropriate.

companyName: FONAR CORP

ticker: FONR


text: Northern Trust also maintains a comprehensive Information and Cyber Security Training and Awareness practice providing baseline and targeted education and awareness for employees and contractors. This program includes at least one required annual online training class for all employees and contractors, supplemental refresher training throughout the year, targeted training based on roles and risk levels, multiple simulated phishing and vishing attacks with associated training, the distribution of regular cybersecurity awareness materials, and the designation of individuals as Information Security and Privacy champions within the businesses.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: The Company's Chief Information Security Officer ("CISO") leads the Company's cybersecurity program and is responsible for the management of its cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor's degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard. Additionally, the CISO is currently enrolled in an Executive course through Northwestern's Kellogg School of Management focused on artificial intelligence ("AI"). The CISO reports directly to the President and Chief Executive Officer. The CISO manages a team of internal and external resources that have expertise and experience in cybersecurity. The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company has an established process governing its assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality. Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to the Company's executive management and/or Board.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer who has a master's degree in computer science, over a decade of information security leadership, and thirty years of combined IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework to communicate with and include executive leadership, outside counsel and the Board of Directors, as appropriate. The Impact Assessment Committee works with the Company's internal and external legal counsel to determine and facilitate appropriate communications with the Board of Directors.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: The Company's Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and routine vulnerability scans, and a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: >on an ongoing basis for certain aspects of our IT team's recurring monitoring and alert processes and round-the-clock support, as needed; and >periodically to perform penetration testing and vulnerability scanning of our systems, websites and properties, run or support tabletop exercises and complete cyber risk-based assessments of us.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: f. Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Corporation.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Encryption and Data Protection: Encryption methods are in place to protect certain sensitive data. There are also programs in place to monitor and secure the Company's retained data.

companyName: DallasNews Corp


text: Our Chief Information Security Officer (CISO) has primary responsibility for the development, operation, and maintenance of our information security program, including assessing and managing risk from cybersecurity threats. The Company's CISO has 30 years of information technology experience, with 17 years focused specifically on information security and risk management. He combines organizational management and leadership skills with a high degree of technical knowledge, the result of hands-on information technology and security experience.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from key third parties such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with senior management, supported by the Company's IT Technician. The IT Technician, who has prior experience in the banking industry, works with senior management to implement and maintain processes designed to protect the Company's information systems and data. This collaborative approach helps ensure that our cybersecurity strategies are aligned with the Company's overall risk management framework.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: AFG has also adopted a Security Incident Response Plan ("SIRP") that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. The AFG CISO leads and facilitates the SIRP team, which also includes AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's Chief Information Officer, AFG's General Counsel and Great American's President and its General Counsel.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity Risk and Compliance Team cybersecurity managing counsel, and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. The Cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls. We also conduct annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform our evaluation. This does not imply that we fully meet any particular industry standards, specifications or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's Internal Audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.

companyName: TPG Inc.

ticker: TPG


text: Our approach to risk management is designed to identify, assess, prioritize and manage major risk exposures, including material risks from cybersecurity threats, that could affect our ability to execute our corporate strategy and fulfill our business objectives. We have implemented, and incorporated into our operations, cybersecurity risk management processes and technologies to protect the integrity, availability and confidentiality of our critical systems and information.

companyName: Stagwell Inc

ticker: STGW


text: Our cybersecurity department, led by our CISO, has primary responsibility for our enterprise-wide information security program, and our risk management team works closely with our cybersecurity department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs on an ongoing basis. Our current CISO has held that position since 2022 and has broad information technology experience as a result of that role and past work experience. Our CISO manages a team with broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats and regulatory compliance. The cybersecurity department receives support to maintain the information security program from other functions, such as information technology, corporate security, internal audit and legal. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from the internal team. We also engage and rely on third parties to support our information security program, such as assessors, consultants, contractors, auditors and other third-party service providers. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and based on the information and information

companyName: NEW YORK TIMES CO

ticker: NYT


text: Our Head of Information Technology (IT) oversees overall cybersecurity management, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic, but at least annually, reports to our Board or the Audit Committee of the Board of Directors, or the Audit Committee. The IT security team has over 40 years of combined technology experience, and over 20 years of experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure. The Company's Cybersecurity Committee is comprised of information technology, finance, legal, human resources, and data privacy employees, including the Head of IT. It meets regularly, but at least annually, to review and provide oversight of the Company's cybersecurity risks and data security programs, policies, and strategies. Pursuant to internal policies, the Head of IT will notify the Cybersecurity Committee of significant cybersecurity incidents and breaches. The Cybersecurity Committee reviews, analyzes, and responds to cybersecurity incidents and breaches. Additional responsibilities and risk mitigation strategies relate to business continuity and business resiliency capabilities.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Prudential also maintains an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with Prudential's corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10 -K, including "An information systems interruption or breach in security, including as a result of cyber-attacks, could adversely affect the Company's business, results of operations and reputation."

companyName: EMERSON RADIO CORP

ticker: MSN


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the HGTO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.

companyName: PRUCO LIFE INSURANCE CO


text: Our CISO has served in various roles in information technology and information security for over 25 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and is a member of the National Association of Corporate Directors ("NACD"). At the management level, our CISO, who oversees our data security personnel, works closely with our Chief Risk Officer, who oversees our incident response and business continuity management programs, to assess and manage the cybersecurity element of our ERM program. Our Chief Risk Officer has extensive familiarity with our business, having been at Dayforce, Inc. for over 20 years. Our Chief Risk Officer focuses on risk management, business continuity planning, crisis management, audit processes, operations management, and executive and board of directors reporting.

companyName: Dayforce, Inc.

ticker: DAY


text: We have a Cybersecurity Governance Committee, consisting of our Chief Executive Officer, our Executive Vice President, Corporate Development and Administration, our Executive Vice President, General Counsel and Secretary, our Senior Vice President and Chief Financial Officer, our Senior Vice President, Corporate Development (formerly the Chief Financial Officer for our U.S. metal container operations), our Vice President of our Business Technology Group and the IT Director for one of our businesses. Our Cybersecurity Governance Committee meets multiple times per quarter to address cybersecurity risks and threats, our responses to such risks and threats, the results of cybersecurity tests and controls and the impact of completed and planned projects to support our cybersecurity environment. We also maintain a cybersecurity working committee among our businesses that is comprised of our Vice President of our Business Technology Group, the IT Directors of our businesses and other key members of our Business Technology Group. The cybersecurity working committee meets at least monthly with a primary focus on goals and improvements to our cybersecurity management processes, and members of our management and of the management of our businesses are invited to attend.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee semi-annually receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks. Members of the Board and the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.

companyName: BioAtla, Inc.

ticker: BCAB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As of the date of this Annual Report, the majority of the Company's IT systems are computed using leading secure cloud platforms.

companyName: Viewbix Inc.

ticker: VBIX


text: Denial of Service (DOS) attacks: There is a risk that a DOS attack could bring down our website and make it impossible to make appointments at clinics, which would have a negative impact on sales. For this reason, we have introduced a WAF to prevent malicious access and DOS attacks.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: Our CTO oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO has served in this role at the Company since 2020, and has more than 25 years of experience in the aggregate in various senior roles involving managing global information technology and security teams spanning strategy, implementation, operations and compliance. The Vice President of Information Technology Infrastructure collaborates with the CTO and a supporting team to maintain and update the Company's technology infrastructure and corresponding safety measures. Our VP of Information Technology Infrastructure has served in this role at the Company for over six years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs. Additionally, our CIO oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. We also maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: A Compliance Committee has also been established and is responsible for overseeing and monitoring all corporate compliance initiatives at Braves Holdings, including cybersecurity. The Compliance Committee is composed of members of the CESC as well as the Braves Holdings executive leadership team, including the President and Chief Executive Officers of the Baseball and Development divisions, Chief Financial Officer and Chief Legal Officer. The SVP and Head of Technology Services provides periodic updates to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Our cybersecurity program is overseen by our Director, IT Infrastructure & Cybersecurity and utilizes a risk-based methodology to support the confidentiality, integrity and availability of our digital assets. The cybersecurity program is supported at the highest level within the Company, formally reporting to the Audit Committee twice annually and more often if required.

companyName: Third Harmonic Bio, Inc.


text: Regarding data privacy, in 2023, our Ethics & Compliance Department implemented an annual privacy awareness initiative known as "Data Privacy Week," celebrating an event known as International Data Privacy Day, which is acknowledged in over 50 countries as promoting data privacy best practices and raising awareness about the importance of data protection. Data Privacy Week messaging includes highlighting the various departments and employees who support our data privacy and security compliance efforts, as well as trivia challenges designed to engage employees on this topic. Finally, our compliance program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. The Audit Committee periodically receives an overview of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: McEwen Inc.

ticker: MUX


text: We also participate and support multiple threat-sharing communities including the National Defense Information Sharing and Assessment Center, the defense industrial base Cybersecurity Program, and the National Defense Cyber Alliance. Participating these communities allows us to collaborate with our Defense Industrial Base sector peers, government agencies, information sharing and analysis centers, and cybersecurity associations. The Cybersecurity Program staff also maintains regular contact with the Federal Bureau of Investigation for sharing of threat information.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an external security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data.

companyName: HilleVax, Inc.


text: Our IRPs, which are tailored to address potential cybersecurity threats in both our product and corporate infrastructure technology environments, are designed to provide a comprehensive, structured response to cybersecurity incidents, and apply to all Strategy personnel, including employees, directors, temporary staff, and contractors. In accordance with our IRPs, we train our personnel to report any cybersecurity incidents to our Information Security Team (IST). Upon identification of a cybersecurity incident, the IRPs mandate that the IST conduct an immediate evaluation and assign a severity rating to the incident and, depending on the severity, report the incident to our Chief Information Security Officer (CISO). Based on the severity of the incident, a Security Incident Response Team (SIRT), the members of which include our Chief Technology Officer (CTO), the CISO, and personnel from various departments, including legal, is convened. The SIRT, with assistance from the IST, is tasked with executing a timely and effective response to the incident, and SIRT members are assigned specific roles and responsibilities, including assessment of the incident's materiality for disclosure purposes.

companyName: Strategy Inc

ticker: MSTR


text: The Company's EVP – Global Business & Information Services reports to the Chief Executive Officer and has 36 years of experience leading information technology functions, which includes information security and incident management prevention and response. Under the direction of the EVP – Global Business & Information Services and the Chief Executive Officer, an internal team within the Company's Information Services department analyzes cybersecurity risks, considers industry trends, and implements controls, as appropriate, to mitigate these risks.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: Oversight and Execution of Our Cybersecurity Risk Strategy Both the Board and the Audit Committee play an important role in the Board's oversight of cybersecurity threats. The Audit Committee receives periodic updates on the Company's risk profile and mitigation strategies and conducts forward-looking discussions about major IT changes that are planned, the risks involved and the Company's potential mitigation strategies. The Audit Committee shares updates with the broader Board. We presently have three Directors, Ann Bordelon, Chair of the Audit Committee, Paulette Dodson, and Noah Glass who have cybersecurity risk management experience and we continue to monitor whether supplemental experience may be useful as cybersecurity threats continue to evolve.

companyName: Portillo's Inc.

ticker: PTLO


text: The Chairs of the Cybersecurity Committee and the Audit Committee periodically update the full Board on specific committee-level topics and discussions. This enables the Board and its committees to coordinate the risk oversight role, particularly with respect to risk interrelationships.

companyName: Dynatrace, Inc.

ticker: DT


text: However, it is difficult or impossible to defend against every risk being posed by changing technologies as well as criminal intent on committing cyber-crime. Increasing sophistication of criminal organizations and advanced persistent threats make keeping up with new threats difficult and could result in a breach. Controls employed by our information technology department and cloud vendors could prove inadequate. A breach of our security that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations, as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage, any of which could have an adverse effect on our business, financial condition, and results of operations. The Company has set the conditions to quickly respond to a cyber incident, ensuring a resilient, digital environment.

companyName: Merchants Bancorp

ticker: MBIN


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Technology. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Inhibrx Biosciences, Inc.

ticker: INBX


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, The Partnership upholds a robust mandatory security awareness program, including required training and phishing campaigns for our employees. The Partnership also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. The Partnership is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Industry— Our failure or the failure of third-party service providers on which we rely to protect our marketplace, networks and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and substantially harm our business and operating results. "

companyName: GigaCloud Technology Inc

ticker: GCT


text: Our business is managed under the direction of our Board of Directors ("the Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our Board views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities. To that end, the Board assures that we maintain robust corporate governance policies designed to promote our culture of uncompromised integrity that have been implemented in a manner that facilitates active oversight and engagement regarding various cybersecurity matters. Consistent with these policies, the Board receives updates regarding cybersecurity threats in connection with its regularly scheduled meetings, as appropriate, and as part of its ongoing strategy and risk management sessions, engages in discussions regarding cybersecurity threats to our operations. In addition to this direct oversight, the Board has delegated oversight responsibilities with respect to cybersecurity risks to the Audit Committee of the Board. In addition to its oversight of the quality and integrity of the Company's financial statements and internal audit functions, the Audit Committee is also responsible for reviewing the Company's key risk areas, including cybersecurity risks.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Our Board oversees our cybersecurity and data protection strategy and appoints a director to lead the Board's efforts. Our Board is briefed on our cybersecurity posture, current and future risks and potential incidents or vulnerabilities on a quarterly basis. Board members and executives participate in engagements on cybersecurity, such as simulated cyber incident response and crisis management exercises. Our Board also regularly receives and reviews third-party cybersecurity assessments, which include assessments of our cyber maturity and cyber risk.

companyName: LITHIA MOTORS INC

ticker: LAD


text: CISO, in his capacity, regularly informs the CEO and the Chief Financial Officer ("CFO") of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing SideChannel, Inc. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: SideChannel, Inc.

ticker: SDCH


text: While the Board has overall responsibility for risk oversight, the Board delegated to the audit committee the responsibility for assisting the Board with oversight and monitoring of matters relating to our risk assessment, risk management, and risk mitigation policies and programs, including matters related to privacy, information technology, and cybersecurity, and for reviewing and discussing with management our risk exposures related to these matters. In its oversight role, the Board is expected to specifically consider risks that relate to our reputation and the general industry in which we operate, including with respect to privacy, information technology and cybersecurity, and threats to technology infrastructure.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge, and testing; using a third-party cybersecurity oversight program;

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: While our full Board of Directors has overall responsibility for risk oversight, it has delegated primary oversight of certain risks to its committees. Our Audit Committee monitors cybersecurity risks, and the steps our management has taken to monitor and control exposures. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) brief the Audit Committee quarterly on cybersecurity risks, updates on the regulatory and cyber landscape and significant cybersecurity events, as needed. Our Audit Committee reports to the Board of Directors on cybersecurity matters quarterly, or more often as the need arises.

companyName: InnovAge Holding Corp.

ticker: INNV


text: The Company does not have any processes for identifying and managing material risks from cybersecurity threats. The Company considers that at the current stages of its development and information systems there are no risks of cybersecurity incidents that have materially affected and are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.

companyName: NIKA PHARMACEUTICALS, INC

ticker: NIKA


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: We provide regular, mandatory training for personnel regarding cybersecurity threats to help equip our personnel with tools to address such threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: VERACYTE, INC.

ticker: VCYT


text: The Company also evaluates the integrity and security of the technology infrastructure of certain third parties that access, process or store data that the Company considers to be sensitive, significant or legally protected. ProAssurance reviews and assesses its third-party providers' cybersecurity controls, as appropriate, and makes changes to the Company's business processes to manage these risks.

companyName: PROASSURANCE CORP

ticker: PRA


text: Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material. The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, CISO, Chief Accounting Officer and Director of SEC Reporting. Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud.

companyName: BLACKBAUD INC

ticker: BLKB


text: GE Vernova considers cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level with consideration of key risk indicators, trends, and countermeasures for cybersecurity and other types of significant risks. GE Vernova does not believe that there are currently any known incidents from cybersecurity threats that are reasonably likely to materially affect GE Vernova or its business strategy, results of operations, or financial condition. As is the case for all large, global companies, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors—Risks Relating to Technology and Intellectual Property" for further information about these risks. We outsource certain cybersecurity functions and will continue to look for opportunities to utilize managed security service providers.

companyName: GE Vernova Inc.

ticker: GEV


text: Incident and risk event levels each vary from no (or low) risk to crisis (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., Federal Reserve, FinCEN, SEC), authorities (e.g., F.B.I., Department of Justice), customers, third parties or internal personnel.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: Our Board of Directors has ultimate risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the Board of Directors on its specific risk oversight activities. The Audit Committee, comprised solely of independent directors, oversees our overall ERM program and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), all of which are fully integrated into our ERM program. The Audit Committee actively reviews and discusses our information security and technology risk management programs and regularly reports out to the full Board of Directors on our relevant strengths and opportunities.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: The audit committee is central to the Board' oversight of cybersecurity risks and bears the primary responsibility for this domain. The audit committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: MetaVia Inc.

ticker: MTVA


text: Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See " Risk Factors - Terrorist attacks, cyberattacks and threats could have a material adverse effect on our business, financial condition and results of operations. " for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Prairie Operating Co.

ticker: PROP


text: The audit committee and the full board receive annual reports from senior management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to certain cybersecurity threats, risks, and mitigations.

companyName: Sweetgreen, Inc.

ticker: SG


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. We have not experienced any material cybersecurity events in the last three fiscal years, and expenses incurred in connection with cybersecurity incidents were not material. However, we do face risks from similar attacks and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. Further, an attack on, or penetration of, our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risks. See "Risk Factors - Attacks on or breaches of our networks or systems, or those of third parties upon which we rely, could degrade our ability to conduct our business, compromise the integrity of our services and our communications platform, result in service degradation or outages, significant data losses, the theft of our intellectual property, investigations by government agencies and damage to our reputation, and could expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data," included elsewhere in this Annual Report on Form 10-K.

companyName: Bandwidth Inc.

ticker: BAND


text: Leading the initial implementation of the ISP, including assessing internal and external risks to institutional data and documenting findings through risk assessment reports and remediation plans. Coordinating the development, distribution, and maintenance of information security policies and procedures. Designing and implementing administrative, technical, and physical safeguards to protect institutional data across the company.

companyName: NBT BANCORP INC

ticker: NBTB


text: Our Chief Information Security Officer ("CISO"), Chief Operating Officer ("COO"), Chief Legal Officer, and other senior members of our digital and technology and risk teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit Committee and/or the full Board of Directors Management receives a cybersecurity and information security maturity assessment from a third-party assessor biennially to gain a third-party view of our cybersecurity and information security program. We have integrated the identification, assessment and management of cybersecurity risks into VF's enterprise risk management program, ensuring alignment with our overall approach to risk oversight by the Board, its committees, and management. The Board receives an annual update from VF senior leadership on cybersecurity and information security matters. The Audit Committee receives regular reports from VF senior leadership, including the CISO, on cyber threats, information security risks and controls, and other program updates, as well as enterprise risk management program updates. The Audit Committee regularly briefs the Board on these cybersecurity matters, and the Board also receives periodic briefings on cyber threats and best practices to enhance our directors' literacy on cybersecurity and information security issues.

companyName: V F CORP

ticker: VFC


text: Despite the policies and procedures that have been implemented to ensure the integrity of our IT systems, we may not be effective in identifying and mitigating every risk in which we are exposed to, especially newly identified vulnerabilities. Furthermore, the hospitality environment requires that the hotels access information in third party environments that are managed, hosted, and provided by others. As such the company will have difficulties in anticipating and implementing preventive measures that mitigate the harm should a break occur.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Despite our efforts to enhance our cybersecurity posture, we cannot guarantee that our processes and controls will be sufficient to prevent or mitigate all cybersecurity risks and threats that we face. We may experience cybersecurity incidents that result in unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; disruption or degradation of our operations; loss of customers or business opportunities; regulatory investigations or enforcement actions; litigation or liability; reputational damage; or increased costs.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Our Internal Audit organization performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each major operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.

companyName: Phillips 66

ticker: PSX