text: We utilize Information Technology Associates ("ITA"), an outsourced IT provider which has been designated with oversight responsibility for our cybersecurity risks. ITA possesses a deep understanding of our information technology systems, including methods to manage and monitor cybersecurity risks. It also provides active monitoring and risk assessments of cybersecurity threats and communicates such threats to our Company. Low risk threats are communicated to our systems analysts, and high risk threats are first communicated to Bill Bennett (our CEO and director), Brady Smallwood (our COO and director), and Gary Schubert, our CFO, and are then discussed with our board of conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance. Additionally, we require our associates to complete cybersecurity awareness training provided by NINJIO.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: In exercising oversight over the Company's information technology risks, including its cyber and information security program, our Board of Directors has established a Technology Committee that is led by the Company's Chief Digital and Information Officer ("CDIO") and is comprised of directors with technology industry backgrounds, all of the Company's executive officers, the Company's Information Security Officer ("ISO") and the Company's Chief Risk Officer. The Technology Committee receives materials on a quarterly basis to address the identification and status of information technology cybersecurity risks. Each year, the full Board of Directors also receives a comprehensive update on the Company's cyber and information security program.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC

secItem: Item 1C


text: The Company regularly engages in assessments, testing and subsequent remediation of our policies, procedures and practices that are designed to address cybersecurity threats and incidents. These efforts include a variety of third-party vendors and activities, including audits, assessments, penetration tests, threat modeling, tabletop exercises and vulnerability testing. We have also engaged a third party to perform an independent review of our information security environment. The results of such assessments, audits and reviews, along with remediation and development plans, are reported by management to the Board and Audit Committee.

companyName: MANITOWOC CO INC

ticker: MTW


text: Our CISO, who reports to our Chief Financial Officer, is responsible for assessing and managing cybersecurity risks. Our CISO has over 20 years of experience in cybersecurity, risk management and information security governance and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications. Our CISO receives reports on cybersecurity threats from our dedicated information technology team on an ongoing basis and, in conjunction with management, regularly review risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO also works closely with our legal and compliance departments to oversee compliance with legal, regulatory and contractual security requirements.

companyName: DocGo Inc.

ticker: DCGO


text: The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the Board of Trustees about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO works closely with Company management, including the CCO, to administer, assess, discuss, and prioritize the Company's cybersecurity efforts.

companyName: Antares Strategic Credit Fund


text: To date, the risks from cybersecurity threats have not materially affected the Company. Our cybersecurity program is designed to detect and prevent cybersecurity events that would have a material adverse effect on the Company. Despite our efforts, however, the threat of sophisticated, targeted computer crime poses a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Notwithstanding our efforts to protect intellectual property and confidential and personal information, our facilities and systems may be vulnerable to cybersecurity events. See "Item 1A. Risk Factors – Risks Related to our Business."

companyName: Strategic Education, Inc.

ticker: STRA


text: The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of talent recruitment and retention, as well as procuring and deploying the correct tools to address threats. Additional information on cybersecurity risks is discussed in Item 1A of Part I, "Risk Factors," under the heading "Technology Risks," which should be read in conjunction with the foregoing information.

companyName: MOODYS CORP /DE/

ticker: MCO


text: We also aim to improve our identity and access management by limiting individuals' access to information only to that which is necessary to conduct their official duties and granting individuals access privileges only to user accounts or processes that are essential to perform their intended functions. Multi-factor authentication and role-based access controls are also core elements of our identity and access management processes. Additionally, we periodically offer training and education to our employees on cyber risks and remind our employees of critical end-user best practices, such as current phishing trends. Information security risk is managed by a cross-functional team, which includes our procurement, compliance, privacy and legal teams, allowing for a holistic view of risks related to the safety and privacy of critical data, such as customer account details, financial data and intellectual property. We aim to secure our data and information throughout their lifecycle – from creation, collection and processing to dissemination, use, storage and disposition.

companyName: QuidelOrtho Corp

ticker: QDEL


text: Impact of Cybersecurity Threats Cybersecurity threats have the potential to negatively impact us due to the use of information technology within our business, and by our suppliers, business partners, and tenants. See "Risk Factors—Risks Related to Our Business—A cybersecurity incident or other technology disruptions could negatively impact our business, our relationships, and our reputation." of Item 1A above for a discussion of cybersecurity risks and the potential impact on us.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is, therefore, charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. Our Corporate Compliance Officer briefs the Audit Committee on cybersecurity risks at each of its meetings, which occur at least four times each year. These briefings include an assessment of cyber risks, an overview of the cyberthreat landscape, updates on cybersecurity incidents and reports on our investments in cybersecurity risk mitigation strategies and technologies and related corporate governance. In addition, our domestic and European chief technology officers brief the Audit Committee on cybersecurity risks at least annually. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Our CEO and Director, Systems & Security, have extensive experience in the information technology area. In particular, our Director, Systems & Security has over twenty years of professional experience in the information security area, including as a result of his roles as a director of security, a security architect, and a software security engineer at various companies.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known as the "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our identification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.

companyName: VIASAT INC

ticker: VSAT


text: The Company has an integrated, cross-organizational risk management approach. As part of our overall risk management processes, we assess, identify and manage material risks from cybersecurity threats through our cybersecurity risk management program which leverages the National Institute of Standards and Technology ("NIST") framework, organizing cybersecurity risks into six categories: govern, identify, protect, detect, respond and recover. However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we leveraged the NIST framework as a guide in the creation of our cybersecurity risk management program. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our Chief Technology Officer, together with our SVP of Information Technology and Security, are responsible for leading, managing, and monitoring the Company's cybersecurity risk with the assistance of our security team (collectively, the "Cumulus Security Team") who monitors cybersecurity incidents using a variety of security information and event management tools. Alerts from those tools are monitored 24/7 and addressed accordingly. The type of incident identified and severity level determine how issues are escalated and who is engaged for resolution pursuant to the Company's internal incident response plan. If a cybersecurity incident or aggregated series of incidents is deemed material, the incident is communicated to various members of the Company's leadership team and the Board of Directors. Disaster recovery and incident response plans are documented for key systems and would be followed in the event a cybersecurity incident occurs.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: We regularly evaluate the cybersecurity threats associated with third -party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third -party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third -party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.

companyName: OCULUS INC.

ticker: OVTZ


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See " Risk Factors – We are subject to cybersecurity risks to operational systems, security systems, infrastructure, firmware in our thermal infrared technology and customer data processed by us or third-party vendors or suppliers and any material failure, weakness, interruption, cyber event, incident or breach of security could prevent us from effectively operating our business."

companyName: MultiSensor AI Holdings, Inc.

ticker: MSAI


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.

companyName: 908 Devices Inc.

ticker: MASS


text: Our Chief Technology Officer is ultimately responsible for overseeing all cybersecurity management, including the three core teams mentioned above, and reports to the Board of Directors twice a year on our cybersecurity tactical responses and strategic roadmap. The entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address enterprise risk management processes and policies.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. See Part I, Item 1A.—Risk Factors— Our business is subject to cybersecurity risks.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: We take a comprehensive approach to cybersecurity risk management. While securing the data customers and other stakeholders entrust to us is a top priority, we, like all companies, are subject to threats of breaches of our cybersecurity programs. Our board of directors (the "Board") and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: ServiceNow, Inc.

ticker: NOW


text: The Board of Directors provides strategic guidance regarding Cars Commerce's overall risk oversight, including identification, management and mitigation of risk. The Board has delegated direct cybersecurity and information security risk oversight to the Audit Committee. Cars Commerce management provides the Audit Committee with regular updates at least quarterly regarding the effectiveness of Cars Commerce's overall cybersecurity program and other cyber security related matters, which may include, Cars Commerce's inherent cybersecurity risks, updates on recent cybersecurity threats and incidents, policies and practices, industry trends, regulatory developments, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats. The Chair of the Audit Committee informs the Board of the outcome of these meetings through updates presented to the Board at regularly scheduled Board meetings.

companyName: Cars.com Inc.

ticker: CARS


text: The IT department provides the ISO with access to its operations and alerts regarding cybersecurity events. Events that could become cybersecurity incidents are reviewed and evaluated by the ISO in consultation with the IT department. Documented escalation procedures are tested regularly as part of tabletop exercises and other activities and include notification to executive management during qualifying cybersecurity incidents. The IT department shares responsibility with the ISO for identifying and prioritizing improvements to the Company's cybersecurity capabilities and resources.

companyName: Finwise Bancorp

ticker: FINW


text: The Company's Chief Information Officer and its Chief Information Security Officer are members of the Company's management that are principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Information Officer serves as Chair of the Company's Cyber Security Committee and works in coordination with the other members of the Cyber Security Committee, which includes our Chief Technology Officer; Chief Information Security Officer; EVP, Operations; EVP, Chief Financial Officer; Chief Compliance Officer; Chief Accounting Officer; Chief Legal Officer; Deputy Chief Compliance Officer; SVP, Public Affairs; VP, Risk Management; VP, Internal Audit; and VP, Legal – Intellectual Property and Privacy, who also serves as the Company's Privacy Compliance Officer and Data Protection Officer.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Our cybersecurity risk management and strategy are overseen by our Chief Information Security Officer, who leads a team with decades of combined experience in information security management, cybersecurity strategy development, and the implementation of effective cybersecurity programs. The team holds a variety of relevant degrees and professional certifications.

companyName: WAFD INC

ticker: WAFD


text: Our Board of Directors retains responsibility for the oversight of our overall risk management systems and processes and our CISO provides periodic reports to the full Board of Directors on cybersecurity risk. The Board of Directors also participates in educational sessions relating to cybersecurity matters.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Our board of directors is kept apprised of cybersecurity risks and assessments through regular presentations to the Audit Committee regarding our information security and privacy governance and reports on information security and privacy incidents. Cybersecurity threats, including as a result of any past cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see the "Risk Factors" section.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: Zurn Elkay's management and Board recognize the importance of robust oversight of cybersecurity risk, information security, and technology risk in maintaining the trust and confidence of our customers, partners, employees, and stockholders. The Audit Committee, on behalf of the Board, oversees the Company's material financial and other risk exposures, including risks related to cybersecurity. Our Board has extensive cybersecurity experience, including two members of the Audit Committee who have received a certificate in cybersecurity oversight from the Carnegie Mellon University Software Engineering Institute. Cybersecurity risk also is monitored, assessed and managed as part of the Company's integrated Enterprise Risk Management program. A cybersecurity governance council, comprised of executive leaders, including the two members of the Audit Committee with cybersecurity experience, meets at least quarterly to review the Company's cybersecurity program and its effectiveness. This cybersecurity governance council receives updates and reports from the Company's global cybersecurity team (discussed below) on the cybersecurity program and its effectiveness relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. The Chief Information Officer (CIO) provides periodic updates to the Audit Committee on any material initiatives and key updates on the cybersecurity program and its effectiveness, including any material threats. The CIO also provides an annual update regarding information security to the full Board. The CIO has more than 36 years of information technology experience, including approximately 18 years serving as a CIO.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: Board Oversight and Cybersecurity Governance Our cybersecurity strategy is anchored in a governance structure with board-level oversight. The Board of Directors plays a critical role in guiding our corporate governance, our cybersecurity posture, ensuring that cybersecurity risks are adequately evaluated and managed in alignment with our business objectives. To this end, the Board will receive periodic updates on our cybersecurity initiatives, risk management practices, and incident response measures. This oversight ensures that cybersecurity remains a top priority at the executive level and that strategic decisions reflect our commitment to safeguarding our digital assets.

companyName: Urgent.ly Inc.

ticker: ULY


text: As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Chord Energy Corp

ticker: CHRD


text: The Board of Directors, both directly and through the delegation of responsibilities to the AEOC, has risk management oversight, which includes the proper functioning of our cybersecurity risk management program. In particular, the AEOC assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Third Party Service Provider Monitoring The Company maintains a robust third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each vendor based on an assessment of the vendor and its access to network, systems, and confidential information. A subject matter expert review is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to the Company's systems or customer data must have appropriate technical and organizational security measures in place, as well as security control principles based on commercially acceptable security standards.

companyName: TFS Financial CORP

ticker: TFSL


text: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing, maintain ongoing risk assessments, and monitor various third-party risk feeds. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program. Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have passed a SOC 2 type 1 audit. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.

companyName: IonQ, Inc.

ticker: IONQ


text: We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: In connection with the Closing, on September 24, 2024, our Board of Directors approved our Cybersecurity Incident Response Policy (the "Cybersecurity Policy"), We have integrated the processes as described in the Cybersecurity Policy into our overall risk management systems and processes According to the Cybersecurity Policy, we routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: We conduct risk assessments of third-party suppliers and service providers including due diligence assessments of third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide all third-party vendors, consultants, and partners with detailed security requirements for securing their connections into our IT networks. Third parties service providers are also typically contractually responsible for identifying and remediating security issues within their technology and service environment.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: We may in the future determine to engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our processes.

companyName: Yale Transaction Finders, Inc.

ticker: YTFD


text: As part of our routine and periodic overall risk management system or processes, we have incorporated various processes related to cybersecurity. Key cybersecurity controls, such as access controls, are included within our internal control framework that we assess annually as part of Management's Annual Report on Internal Control Over Financial Reporting. Additionally, periodic discussions are held with outsourced IT professionals for both corporate and consolidated plant environments to determine if appropriate actions are being taken to address potential risks. Through the assistance of our qualified third-party IT professionals, we have implemented numerous security measures, including, but not limited to, multi-factor authentication on critical systems, password requirements, access controls, and data encryption.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: Enterprise risk management is a matter that is reviewed and addressed by the entire Board. The Noble Enterprise Risk Management Program, which includes the Company's cyber security enterprise risk, is updated by management and reported to the Board of Directors quarterly. The quarterly update to the Board of Directors includes information regarding cyber related risks, initiatives, and potential and actual cyber security threats and incidents. The CIO or their dedicated deputy is responsible for reporting cyber security risks and events to executive management as well as the Board of Directors, as appropriate. Specific issues or threats may be escalated to the Chief Executive Officer or the Board of Directors between quarterly updates by the CIO, as appropriate, and the Information Security Team keeps management informed about initiatives, threats, incidents, training, and best practices on an on-going basis via circulated memos or meetings. In addition to reporting through the Enterprise Risk Management Program, the Board of Directors also includes cyber security as an independent agenda item periodically and engages with the CIO and Information Security Team as well as external experts on cyber security matters.

companyName: Noble Corp plc

ticker: NE


text: In addition, our processes also address cybersecurity threat risks associated with our use of third-party software and service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on critical third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties to agree by contract to manage their cybersecurity risks in specified ways to be subject to cybersecurity audits, which we may conduct as appropriate.

companyName: Fortive Corp

ticker: FTV


text: There can be no assurances that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or are effective in protecting our systems and information.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: Cybersecurity incident events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.

companyName: TEJON RANCH CO

ticker: TRC


text: Cyber risks are an enterprise risk that the ERM Program monitors and thus such risks are an ongoing area of focus of the ERM Steering Committee and, as a result, the Risk Committee. On a monthly basis, the ERM Steering Committee is convened and receives pertinent updates regarding our management of cyber risks.

companyName: TRINET GROUP, INC.

ticker: TNET


text: While all vendors are subject to our vendor management process, those with access to our data and data centers are subject to more rigorous initial and ongoing due diligence. This includes the reviews of Service Organization Control 2 ("SOC 2") reports, financial information, and other policies and procedures related to such third-party vendors and their various programs, including vendor management.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: We measure our cybersecurity effectiveness through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures around the effectiveness of our cybersecurity controls, our ability to manage cybersecurity events and incidents, cybersecurity incident response exercises, and results of our recurring internal assessments, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control performance, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers and the Cybersecurity and Digital Technology Committee.

companyName: AMEREN CORP

ticker: AEE


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: WILLAMETTE VALLEY VINEYARDS INC

ticker: WVVI


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Company, we employ processes to assess, identify and manage material risks from cybersecurity threats. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data.

companyName: Lomond Therapeutics Holdings, Inc.


text: If an incident is detected, the Cybersecurity team follows the incident response policy to investigate, review and determine the potential impacts of such an incident. If the Cybersecurity team determines that an incident could reasonably be expected to have an impact on the financial condition or operations of the Company, it escalates the incident to the crisis management team, which includes executive management. The crisis management team further evaluates the potential impact and materiality of an event and the appropriate response required. The crisis management team coordinates the appropriate response effort and communicates, as applicable, to the Audit Committee. To the extent that Cybersecurity incident is determined to be material, the appropriate public disclosures are made.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: The Audit Committee is responsible for reviewing and assessing the overall cybersecurity risk management program and management's processes and policies with respect to cybersecurity risk monitoring, identification, assessment, and response. Senior management and the Audit Committee receive an annual update and ongoing quarterly updates on Bunge's cybersecurity readiness and the current "threat environment," which includes an update on the cybersecurity threat landscape, the strategic priorities of the cybersecurity risk management program and progress made in respect of those priorities, a review of cybersecurity incidents, as well as additional updates on an as-needed basis. Our internal audit team also reports to the Audit Committee on the effectiveness of management in identifying and appropriately controlling risks, including cybersecurity risks. The Audit Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.

companyName: Bunge Global SA

ticker: BG


text: Cybersecurity risk management is a major component of our overall risk management systems and processes. We have a cybersecurity program and governance structure designed to identify and manage cybersecurity risks and threats. The program encompasses a comprehensive framework that begins with a clear governance structure comprised of our Chief Technical Officer (CTO), Director of Internal Audits, and Senior Director of Compliance, ensuring a holistic approach to risk management. Regular reporting mechanisms to the board and senior management keep all stakeholders informed about the evolving cyber risk landscape and the program's effectiveness.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: We rely on our systems and networks to support our business activities. As some networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: All employees are required to complete cybersecurity training and have access to more frequent cybersecurity training through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Director of Information Security, Vice President of IT, our President and our Board of Directors. The Audit Committee receives periodic reports on the Company's cybersecurity measures, protections, response plans, etc. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

companyName: REGIS CORP

ticker: RGS


text: To our knowledge, cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition. With regard to the possible impact of potential future cybersecurity threats or incidents, refer to the section titled "Information Technology or Cybersecurity Risks" under Item 1A, Risk Factors.

companyName: LAKELAND BANCORP INC


text: Our cybersecurity risk management efforts include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Cuentas Inc.

ticker: CUEN


text: Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework and is organized into five key functions: identification, protection, detection, response and recovery. We regularly assess the threat landscape and employ a layered cybersecurity strategy to prevent, detect and mitigate threats.

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: Managing cybersecurity risk within Cass is an ongoing, multifaceted process aimed at safeguarding digital assets and sensitive information. Led by the Company's Chief Information Security Officer ("CISO") and overseen by the Executive IT Council, the Company has a dedicated team of security professionals to implement the Company's information security processes.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company maintains a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: Warby Parker Inc.

ticker: WRBY


text: We use third -party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees [from our information technology department], our senior vice president of operations and engineering, and our board of directors. The board of directors, Audit Committee, and senior and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management protocols are comprised of software programs including antivirus protection, end-point threat detection, remote access, multifactor authentication. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an employee handbook as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to incident response, confidential information and the use of internet, social media, email and wireless. These policies go through an internal review process and are approved by our senior vice president of operations and engineering.

companyName: Nuwellis, Inc.

ticker: NUWE


text: Third-party service providers are also utilized by the Enterprise Cybersecurity team to play a supporting role in incident response, threat intelligence, firewall management, vulnerability management and endpoint management and detection.

companyName: Aptiv PLC

ticker: APTV


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented and maintain a security risk management program that is designed to preserve the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: CALLAN JMB INC.

ticker: CJMB


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: CG Oncology, Inc.

ticker: CGON


text: All IT assets and infrastructure are monitored 24/7/365 through a combination of MDR, SIEM software and a fully staffed 24/7 SOC. We have continuous monitoring for viruses, intrusions, and malicious activities.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Associate Director, IT Operations and Security, who oversees the ISMS and Information Security Team and reports to the Vice President, Head of IT. The Vice President, Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Vice President, Head of IT is responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT role is currently held by an individual who has approximately 35 years of professional IT management experience. The Associate Director, IT Operations and Security leads the operational and ISMS oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare employees and third-party service providers to address cybersecurity risks. The Associate Director, IT Operations and Security has approximately 10 years of experience in IT including infrastructure and cloud administration, participation in risk management and incident response activities, vendor management, and ensuring information security policy compliance.

companyName: Vor Biopharma Inc.

ticker: VOR


text: The company's Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance and audit readiness. Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Cybersecurity Strategy: PyraMax Bank's cybersecurity strategy is aligned with its overall business objectives and risk appetite. Key components of the Bank's cybersecurity strategy include:

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Our cybersecurity risk management program is led by our Chief Information Officer (" CIO ") through our Information Security Committee ("ISC"), which includes a cross-functional group of senior leaders who are responsible for the dissemination and promotion of our cybersecurity strategy, implementation of cybersecurity objectives and top-down communication and monitoring of the risk management program as described above. Our ISC is responsible for the regular oversight of cybersecurity risk, information security and technology risk and assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Role of our Management Team Our Executive Vice President - Business Intelligence is responsible for the day-to-day management of our cybersecurity risks and for recommending the strategies and technologies used by the organization to collect, integrate and analyze business information to support the organization's strategic decisions. He is supported by a cross-disciplinary team from the Company's accounting, legal and risk oversight functions and its internal audit group. This incident response team meets quarterly and as needed to review the Company's cybersecurity risk management initiatives and progress and cybersecurity metrics. On an annual basis, the incident response team coordinates a cybersecurity risk assessment. In the event of a suspected cybersecurity incident, the team will coordinate the Company's evaluation, subsequent response and any updates to the cybersecurity risk management program with executive management and the cyber subcommittee.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: We are not aware of any risks from cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to AerSale's Business and Industry—Our business could be negatively affected by cyber or other security threats or other disruptions" in "Risk Factors" on page 13 of this Form 10-K.

companyName: AerSale Corp

ticker: ASLE


text: Following these risk assessments, as necessary, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, to manage the risk assessment and mitigation processes.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an information systems security policy; incident management; disaster recovery procedures; periodic backup recovery tests; risk assessments; encryption of certain data; network security controls; data segregation for certain systems and environments; access controls; physical security; asset management, tracking, and disposal; systems monitoring; employee training and phishing simulations; penetration tests; outsourced managed detection and response services; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.

companyName: DBV Technologies S.A.

ticker: DBVT


text: We continually seek to update our IT security, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts to evaluate the efficacy of our security measures. We engage reputable third parties to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness. Risks from cybersecurity threats, including as a result of previous cybersecurity events encountered by the Company and known events encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: 2.Awareness Programs: All employees participate in an ongoing program of mandatory annual training and receive periodic communications regarding the cybersecurity environment to increase awareness throughout the Company. We also implemented an enhanced annual training program for specific specialized employee populations.

companyName: Bristow Group Inc.

ticker: VTOL


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our CISO regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks. In addition, we have an Information Security Governance Council, made up of members of our senior management team as well as relevant information security personnel, that meets periodically to discuss and address relevant cybersecurity matters.

companyName: Genpact LTD

ticker: G


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: We have a cross-functional approach to addressing cybersecurity risk, with our information technology, legal, and internal audit functions regularly presenting to the Audit Committee and Technology & Operations Committee on key cybersecurity topics. Our CISO, together with our CIO and other members of the senior leadership in our information technology organization, also provide the Audit Committee and Technology & Operations Committee with regular updates on at least a quarterly basis, and more often as needed. These reports include topics such as analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status.

companyName: WORLD KINECT CORP

ticker: WKC


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the Audit Committee. Our CISO possesses over 25 years of experience in various technology and cybersecurity operations, holds the Certified Chief Information Security Officer (CCISO) certification from EC-Council and certifications from ISC2, Information Systems Security Management Professional (ISSMP), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC) as well as ISACA certifications of Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). Other key members of management assist our CISO in the oversight of cybersecurity risk management.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: The Company's information security program is designed to protect the security, confidentiality, integrity and availability of the Company's sensitive and personal information and client information. Employing a risk-based approach, the program systematically identifies, assesses and implements safeguards that seek to mitigate cybersecurity threats and secure the Company's information assets, including those of our sub-servicers. The program is informed by the National Institute of Standards and Technology Cybersecurity Framework and is shaped by the legal requirements derived from authoritative sources such as the Gramm-Leach-Bliley Act and its implementing regulations and guidelines, as well as Freddie Mac's mandates from the office of Federal Housing Enterprise Oversight. Additionally, the program is guided by relevant state laws and regulations.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee oversees major enterprise risks, and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by third party consultants. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: Village Farms International, Inc.

ticker: VFF


text: To date, there have not been any cybersecurity threats or incidents that have materially impacted or are reasonably likely to materially impact our business strategy, results of operations or financial condition. In the ordinary course of business, we have experienced and will continue to experience cyber threats and incidents of varying degrees. Refer to Item 1A. "Risk Factors" for a discussion of risks related to data security and the associated risks to our business.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: We have established an internal cross-functional leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The committee is chaired by our CISO and is comprised of the President and Chief Financial Officer, Chief Legal Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product. This committee oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Seer, Inc.

ticker: SEER


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. For further discussion of risks related to data protection, cybersecurity, and intellectual property, please see Item 1A, "Risk Factors".

companyName: ContextLogic Inc.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information and systems, and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. See also "Item 1A. Risk Factors — Cybersecurity and Information Technology Risks."

companyName: MYR GROUP INC.

ticker: MYRG


text: We have developed and implemented our Information Security Management System (ISMS), which includes robust processes for identifying, assessing and managing risks from cybersecurity threats. Cybersecurity risk is included in AAM's "Top Risks Assessment" under our enterprise risk management program as identified and monitored by our Risk Management Working Group. This group is comprised of leadership from the major functions within AAM and the enterprise risk management program includes the identification and continuous evaluation of the risks associated with the systems and information most critical to AAM and the processes and controls in place to protect the systems and information.

companyName: Dauch Corp

ticker: DCH


text: The Company's cybersecurity objective is to protect Garrett against data privacy breaches, information theft, and external and insider cyber threats through the use of a combination of leading technologies, policies, and procedures. The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management ("ERM") process and have been embedded in the Company's operating procedures, internal controls and information systems. To that end, we take a holistic approach to securing our data and business systems from attack, compromise or loss.

companyName: Garrett Motion Inc.

ticker: GTX


text: Primerica has processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity risk is integrated into Primerica's enterprise risk management system. Primerica's enterprise risk management and internal audit functions conduct regular assessments and audits of risks from cybersecurity threats and report the results to the Board of Directors at least quarterly. The Board considers cybersecurity risk as part of its business strategy, risk management, and financial oversight.

companyName: Primerica, Inc.

ticker: PRI


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches; Ensuring that changes to security configurations are documented, approved, and tested; Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks;

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Risk Committee of the Board of Directors is ultimately responsible for oversight of cybersecurity risk, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted.

companyName: BankUnited, Inc.

ticker: BKU


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: The CISO is informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The Company deploys a Security Operations Center team who monitor and escalate cybersecurity events. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan, which is intended to mitigate the impact of the incident and includes long-term strategies for remediation and prevention of future incidents.

companyName: Civeo Corp

ticker: CVEO


text: Our corporate information security organization has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement (DFARS) related to adequately safeguarding controlled unclassified information (CUI) and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance. Moreover, we continue to work with the DoD on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. For example, we have worked in collaboration with the other members of the defense industrial base to support DoD's development of the Cybersecurity Maturity Model Certification (CMMC) program, DoD's program to ensure members of the defense industrial base meet cybersecurity requirements for handling CUI and federal contract information. We believe we are well positioned to meet the requirements of the CMMC and are preparing for certification. In addition to following DoD guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. For example, we use a proactive risk management strategy that we developed and implemented called the Intelligence Driven Defense model that seeks to identify and prevent cybersecurity incidents by understanding the nature of adversaries and using this information to minimize the impact of an attack.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Board of Directors. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: QMIS TBS Capital Group Corp.


text: In addition, the Company retains third-party security firms in different capacities to provide some of these controls or monitor cybersecurity threats to our technology systems. For example, third parties are used to conduct independent assessments, such as vulnerability scans and penetration testing, and to confirm PCI DSS compliance. Additionally, third parties are also used to monitor security alert systems.

companyName: DILLARD'S, INC.

ticker: DDS


text: As part of its oversight responsibilities over the Company risks and controls, the Board ultimately is responsible for overseeing our cyber and information security risks, including our program for GLBA compliance. The Board has delegated this responsibility to its Risk Committee. The highest-level rated incidents are brought immediately to the attention of the Chair of the Board and/or the Chair of the Risk Committee. At each regular meeting of the Risk Committee, our ISO reports to the Risk Committee regarding any level one through three events (non-critical to medium) threats, as well as security testing, training, audits, key cybersecurity metrics, and our efforts to identify, prepare for, prevent, and respond to critical threats. The Risk Committee receives regular updates on the status of our information security program, penetration testing results, infrastructure assessments, threat environment, security operations, operational events, vendor and supply chain security, and application/data security.

companyName: CapStar Financial Holdings, Inc.


text: Our Board of Directors and Audit and Compliance Committee oversee the Company's cybersecurity risk management program, which is operated by senior management. Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit and Compliance Committee.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: We are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we constantly face risks from cybersecurity threats. There can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that could materially affect us. Additional information about the cybersecurity risks we face is discussed in Item 1A. Risk Factors, which should be read in conjunction with the information above.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Our VP of Information Technology and support team also have a reporting responsibility to the executive leadership and the Board. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the Board and other stakeholders on an as needed basis. The Board receives regular reports from management on our cybersecurity program, risks and activity.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources, including maintaining cybersecurity insurance coverage, to sustain and enhance our information security and controls or to investigate and mitigate security vulnerabilities. As a result, cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes. Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: FISERV INC

ticker: FISV


text: The CISO and Cybersecurity Manager support the information security risk oversight responsibilities of the Board and its committees. The CISO reports to our Chief Information Officer, who in turn reports to our Chief Executive Officer and President. The Cybersecurity Manager reports to the Information Technology Director, who in turn reports to the Chief Information Officer.

companyName: FIRST BANCSHARES INC /MS/


text: The Board of Directors are acutely aware of the critical nature of managing risks associated with cybersecurity threats. Each quarterly meeting, management presents a cybersecurity update which includes results of testing by third-party vendors and any suspected cybersecurity incidents to the entire Board of Directors. Management would report any material cybersecurity breach immediately to the full Board of Directors. The Company has a written policy for the employee reporting of any cybersecurity suspected incidents.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: We engage certain third-party service providers to perform a variety of functions within our business and seek to ensure that we work with reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing provider cybersecurity practices, conducting provider security assessments, and conducting periodic provider reassessments during their engagement.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: We recognize that cybersecurity risk is a critical enterprise concern. To mitigate cybersecurity risk, we have obtained cybersecurity insurance coverage and established a Cybersecurity and IT Governance Program to stay at the forefront of security and threat management. Our program monitors and assesses our IT environment to provide continuous improvement and automate incident response. We have instituted best practices for preventive safeguards, governance, monitoring, detection, response and third-party validation. Data, updates and results from our program are provided to the Audit Committee at regularly scheduled meetings.

companyName: Cano Health, Inc.


text: Further, employees outside of our information technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, we provide our employees with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulated phishing campaigns, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to Company policies that we make available to all employees, our cybersecurity awareness training provides clear reporting and escalation processes in the event of suspicious activity.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Apollo Infrastructure Co LLC


text: We have recently also established a Security Governance Council ("Council") that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls. The Council membership is led by the Chief Information Security Officer ("CISO") and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents. The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs. Our CISO also holds a bachelor's degree in computer science and maintains Certified Information Systems Security Professional certification.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 25 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.

companyName: Aimco OP L.P.


text: Our internal cybersecurity team collaborates with external cybersecurity service providers, including auditors, consultants and governmental agencies, to refine our cybersecurity measures. These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over four years and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. "The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents and expenses incurred from cybersecurity incidents were immaterial (including penalties and settlements, of which there were none). For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "Risks related to our intellectual property, cybersecurity, information technology and data management practices", which are incorporated by reference into this Item 1C.

companyName: General Motors Co

ticker: GM


text: The Company's information security team, led by our Chief Information Security Officer ("CISO"), helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: CISO and our Chief Executive Officer play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Asset Management The AGM CISO, in coordination with Technology and ERM, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM Audit Committee or AGM board, as appropriate.

companyName: Apollo Global Management, Inc.

ticker: APO


text: All employees are required to complete cybersecurity training semiannually, with additional on-demand training and phishing campaigns offered throughout the year. InfoSec GRC's approach to cybersecurity is structured to align with Wolfspeed's business goals, objectives and regulatory requirements and covers all company locations, globally.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Our Board has delegated to its Audit Committee specific, first-line responsibility for overseeing major cybersecurity risk exposures in addition to our broader ERM program. Specifically, under its charter, the Audit Committee is responsible for overseeing our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations to address and resolve any breaches or issues related to the protection or privacy of our data. Management (including our Chief Information Officer ("CIO") and our CISO) reports at least quarterly to the Audit Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel. The Audit Committee chair reports to the full Board on these risk discussions as appropriate. At least annually, the Board meets with members of our ERM team to review and discuss our ERM program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the Board and its committees.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Board's Audit Committee (the "Audit Committee") oversight of information security matters and risks, including reviewing information technology procedures and controls. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our Adviser and our Adviser is a subsidiary of J.P. Morgan. As such, we are reliant on J.P. Morgan for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Education and Awareness We promote a culture of security awareness among our employees, and our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting the data of members, customers, suppliers, employees and others, including through our Security Awareness Training Program delivered to new hires and on an annual basis. This training, which includes "phishing" exercises, is designed to enhance employee awareness of how to detect, respond to, and report potential cybersecurity threats as well as best behavioral practices to mitigate the risk of becoming subject to a cybersecurity incident.

companyName: Premier, Inc.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Golub Capital Direct Lending Unlevered Corp


text: Management team is responsible for the oversight and administration of cyber security protocols. Our management team relies on our third-party providers on administrating cybersecurity assessments to identify, manage, mitigate, and respond to cybersecurity threats. Management updates the Board as necessary, regarding any significant cybersecurity occurrences.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our or our operators' information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our or our operators' information and operational technology systems.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: Company maintains a strong information security program and systems ("Cybersecurity System") to guard against unauthorized access, malicious software, corruption of data, disruption of its networks and systems and unauthorized release of confidential information. The Company's Cybersecurity System is comprised of multiple layers of controls to reduce the risk of cybersecurity incidents.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Executive leadership Our VP of Information Technology and the information security team periodically present information about the Company's information security program, including program goals and actions, progress against key initiatives and key risks, to our executive leadership team. As described above, significant risks related to cybersecurity are escalated to the Audit Committee and/or the full Board as appropriate.

companyName: Outset Medical, Inc.

ticker: OM


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our executive management will update the board of directors on cybersecurity risks on a periodic basis, with a minimum frequency of once per year.

companyName: CFN Enterprises Inc.

ticker: CNFN


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment. We use a third-party consultant to provide us with advisory, project execution, and operational support in connection with cybersecurity and to conduct NIST assessments and vulnerability evaluations. Cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: The Bank engages in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, penetration tests and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are analyzed by the cybersecurity team and the Information Technology Oversight Committee ("ITOC") and provided to the Bank's Board of Directors. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Index to Financial Statements • A security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls. • Our Internal Audit department which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment. • Periodic cybersecurity awareness training for our employees and contractors with access to our information technology systems. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including incidents that could be indicators of attack against availability, integrity and confidentiality of information systems. • A third-party risk management process for service providers, suppliers, and vendors that includes examining their security postures and assessing their data and system protection controls.

companyName: Bloom Energy Corp

ticker: BE


text: Technical safeguards and incident response and recovery efforts. As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles. These tools and procedures are intended to be consistent with ISO and NIST frameworks. In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.

companyName: Angi Inc.

ticker: ANGI


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by the IT Committee, with support from their third-party consultants. The IT Committee alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing their severity and determining potential responses, as well as communicating with business leaders and senior management, and the Board of Directors, as appropriate.

companyName: Great Elm Group, Inc.

ticker: GEG


text: At least annually, we conduct tabletop exercises to simulate various attacks, enhancing our preparedness against potential threats. These tabletop exercises are conducted with the support of third-party cybersecurity experts. We perform continuous monitoring and detection of our systems, networks, and data repositories for suspicious activities by leveraging a third-party that provides 24x7 comprehensive monitoring of activity that is outside the normal patterns for our day-to-day operations. Our information security team works to stay up to date on threat intelligence through partnerships with outside agencies. We accumulate security event data into our security information and event management, or SIEM tool that tracks and monitors events providing a comprehensive view of how to respond to various threats.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Our approach to controls and risk management is informed by applicable laws and regulations, as well as industry standards and best practices. These serve as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Relevant Expertise: a Our CTO has over 15 years of experience in cybersecurity management, and has a background in security and information technology solutions.

companyName: IREN Ltd

ticker: IREN


text: At the employee level, we maintain an experienced IT security team tasked with ongoing reviews of our technology systems, implementation of our privacy and cybersecurity program and support for the CIO and CISO in carrying out their reporting, security and mitigation functions. We also hold employee training on privacy and cybersecurity, records and information management, conduct regular phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Additional information on cybersecurity risk we face is discussed in Part I, Item A – Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Marpai, Inc.

ticker: MRAI


text: Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, the Director of IT, Head of Resource Management and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN