text: Our cybersecurity risk management program is guided by frameworks and standards promulgated by the EU, National Institute of Standards and Technology, Cloud Security Alliance ("CSA") and International Organization for Standardization/International Electrotechnical Commission ("ISO/IEC"). While we seek to maintain ISO/IEC 27001:2013 and ISO/IEC 27017:2015 certifications, and seek to achieve the SOC 2 Type 1 and Type 2 attestations, this does not imply that we specifically or comprehensively comply with technical specification or requirements, only that we use all the above-mentioned standards and regulations as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Board of Directors' Oversight of Risks from Cybersecurity Risks Cybersecurity risks are overseen by our full Board of Directors with input from the Audit Committee, which reviews the results of internal audit assessments and tests related to cybersecurity. As part of this oversight, the Board of Directors and the Audit Committee meet regularly to discuss the progress of ongoing initiatives and to seek coordination between enterprise stakeholders. At these meetings, our Chief Information Officer ("CIO"), who oversees the Company's cybersecurity program, along with the Chief Information Security Officer ("CISO") and key subject matter experts, as necessary, review current and emerging cybersecurity-related threats as well as key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance in countering these threats. Based on the information provided through these various processes, our Board of Directors evaluates the risks facing us and provides guidance to management on our risk management strategy.

companyName: HF Sinclair Corp

ticker: DINO

secItem: Item 1C


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity risk management also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Cybersecurity Leaders (as defined below) and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: No material cybersecurity incidents occurred in fiscal 2024, but future incidents cannot be predicted. Additionally, in " Item 1A. Risk Factors " under the heading "Cybersecurity and Technology Risks," forward-looking cybersecurity threats that could have a material impact on our business are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to the Board of Directors.

companyName: Track Group, Inc.

ticker: TRCK


text: The Company relies on various third party providers, such as vendors, suppliers and other business partners for certain aspects of its operations. These third parties may also be susceptible to cybersecurity risks. The Company conducts due diligence on the cybersecurity practices and controls on these providers, as well as inclusion of contractual provisions requiring the providers to maintain appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, the Company identifies and mitigates risks to minimize impacts to us from third party incidents.

companyName: Science Applications International Corp

ticker: SAIC


text: Our Board of Directors annually reviews and approves the Company's Risk Appetite Statement, which defines key risk categories and associated metrics that are monitored quarterly by Management and reported to the Risk Committee. Management measures and reports inherent risk, mitigating controls, and residual risk for each key risk category and identifies and regularly discusses emerging risks with the Risk Committee.

companyName: BANNER CORP

ticker: BANR


text: The Board, through the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that would meet the applicable established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least twice each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Chief Operating Officer.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Our cybersecurity program includes, among other things: • ongoing monitoring of systems for security threats at a base level • an internal team that focuses on higher level threats and conducts threat hunting activities • monitoring of the cyber threat landscape using a variety of sources, including engagement with domestic and international governmental security agencies, and industry groups • periodic engagement of third parties to test for vulnerabilities in our information technology systems, assess cybersecurity risk levels, and assess our cybersecurity policies and framework • compliance audits of our information technology processes by our internal audit team, which also monitors the progress of any remediation activities • employee training to raise awareness of cyber risks and behaviors that increase vulnerabilities • periodic exercises to test information technology security protocols • periodic exercises to test information security protocols to enhance crises management readiness and business continuity capabilities • systems and processes designed to assess, oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use • overseeing alignment with customer cybersecurity requirements • a Cybersecurity Incident Reporting process Cybersecurity Incident Reporting Process ("CIR Process")

companyName: Helmerich & Payne, Inc.

ticker: HP


text: The Company implements processes to assess and manage risks associated with using third-party information system service providers. This risk assessment process assesses both the service provider's security posture as well as the security controls available from the third-party information system. The service provider's security posture assessment includes reviewing any third-party attestations as well as third-party controls in the following areas: assets, data flows, authentication, access, monitoring, response and recovery. Depending on the type of system or data, additional controls may be assessed.

companyName: OSHKOSH CORP

ticker: OSK


text: We recognize the critical importance of cybersecurity in upholding the safety and security of our systems, services and data and maintaining the trust of our customers. Cybersecurity risk management is an important part of, and is integrated into, the Company's overall enterprise risk management program. We maintain a cybersecurity risk management program that is designed to identify, assess, manage and mitigate cybersecurity risks and provides a framework for responding to cybersecurity threats and incidents. We continually assess and enhance our cybersecurity risk management program and our cybersecurity posture to protect the confidentiality, integrity and availability of the Company's infrastructure, resources and information and the information that our customers entrust to us.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: In the ordinary course of our business, we collect, process, store, and transmit players' data, including confidential, sensitive, proprietary, and personal information. Maintaining the confidentiality, integrity and availability of our information technology systems and data, as well as appropriate limitations on access to such information, is important to our operations and business strategy. To this end, we have implemented various Information Security programs aligned to ISO and NIST cyber security frameworks with functions incorporating the "Identify", "Protect", "Detect", "Respond", and "Recover" concepts. They are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: GAN Ltd


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over ten years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: FS KKR Capital Corp

ticker: FSK


text: Cybersecurity partners to the Company, including consultants are a key part of the Company's cybersecurity risk management strategy and infrastructure and provide services including, cyber risk advisory. Breeze partners with industry recognized cybersecurity providers leveraging third-party technology and expertise.

companyName: Breeze Holdings Acquisition Corp.


text: Our Board Risk Committee generally meets quarterly and is responsible for overseeing cybersecurity risk and our information security program, including cybersecurity, and ensuring the continued development of the program as the Company grows and cyber and information risk exposures change. At each Board Risk Committee meeting, the chief information security officer presents information security metrics and any updates to the Information Security Program. New and changing cybersecurity risks are discussed when needed. The chair of the Board Risk Committee also serves as a board member and previously served as the chair and interim chief executive officer of the Information Systems Audit and Control Association. As a board member of the Information Systems Audit and Control Association, she is a member of their Audit and Risk Committee, Compensation and Human Capital Committee and Governance and Nominating Committee. All cybersecurity-related policies are reviewed and approved annually by the chief information security officer, Enterprise Risk Management Committee, Board Risk Committee and the board of directors.

companyName: Sterling Bancorp, Inc.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property and proprietary business information theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; physical damage to utility and transmission infrastructure; and reputational harm. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks. As part of our enterprise risk management program, we consider cybersecurity risks alongside other risks in our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying material cybersecurity threats, assessing their severity, and deploying potential mitigations. We have implemented cybersecurity programs at both Southwest and Centuri that are tailored to the distinct businesses of our two segments.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: We have an enterprise-wide information security platform, which is part of our enterprise risk assessment process and designed to protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we seek to use best-in-class security tools that help prevent, identify, escalate, investigate, resolve and recover from identified security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. We also maintain a third party security operations service to identify, prioritize, assess, mitigate and remediate risks. We rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: We also enhance our information technology infrastructure and security protocols to assess, identify, protect against, and manage material risks from cybersecurity threats following a risk-based approach. In addition, we conduct cybersecurity risk assessments at least annually, and periodically engage an independent auditor or other external assessors to aid in pro-active risk identification, prevention, detection, mitigation, and remediation. Our efforts to manage against cybersecurity threats are further guided by Federal and state laws, as well as contractual commitments with third parties, which regulate our collection, use and disclosure of confidential information such as protected health information and personally identifiable information.

companyName: HUMANA INC

ticker: HUM


text: The Company and its business units leverage several information security controls frameworks, standards and best practices with the International Organization for Standardizations (ISO) 27001 used as the overarching framework. ISO 27001 establishes a multi-pronged information security standard for organizations to manage information security risks, build cyber resilience, and improve operations.

companyName: Graham Holdings Co

ticker: GHC


text: We enforce collection, storage, and access controls of personal, proprietary, and confidential information, focusing on protecting trade secrets, intellectual property, clinical trial data, third-party information, and employee data.

companyName: Ingevity Corp

ticker: NGVT


text: In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. We have retained VeraSafe, LLC ("VeraSafe") to help review and monitor our practices and processes related to personal data and compliance with applicable data protection laws. VeraSafe acts as our Data Protection Officer pursuant to the European Union and United Kingdom General Data Protection Regulation and has served in this capacity since May 2021.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: We maintain a broad, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, our Trusted Supplier Program is designed to ensure manufacturing partners undergo a selection and qualification process that adheres to NIST 800-161.

companyName: Fortinet, Inc.

ticker: FTNT


text: While Entergy and the Registrant Subsidiaries have experienced cybersecurity incidents, except as otherwise summarized above or discussed elsewhere in this report, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected them including their business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors" in Part I, Item 1A for a detailed description of the risks related to cybersecurity.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The full Board of Directors has the overall responsibility for risk oversight, including cybersecurity matters. At a management level, our cybersecurity program is led by our Information Technology manager, who reports to the Chief Financial Officer. Our Information Technology manager is equipped to help navigate the landscape of cybersecurity risks and challenges and to implement and manage a comprehensive security strategy.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted periodically. Management conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Our Chief Information Security Officer also provides quarterly briefings to the Cyber Risk Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents of interest and related responses, cybersecurity systems testing, applicable activities of third parties, and the like. Our Cyber Risk Committee provides regular updates to the board of directors on such reports.

companyName: RAMBUS INC

ticker: RMBS


text: Based on the information available to us as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: STAAR SURGICAL CO

ticker: STAA


text: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures. The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives a information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues. The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.

companyName: CITIZENS, INC.

ticker: CIA


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO, CPO, CIO, and VP of Global IT Security. Our security, privacy, and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. These leaders have relevant degrees and certifications, including Certified Information Systems Auditor, Certified Information Systems Security Professional, Fellow of Information Privacy, and Certified Information Privacy Professional. As described above, we have experienced professionals in the key roles of the CISO, CPO, CIO, and VP of Global IT Security. The cybersecurity and privacy offices are responsible for incident reporting and management, which includes cybersecurity threats. The Incident Response team, comprising key cross-functional professionals and stakeholders globally, meets weekly and as needed to identify, respond, contain, and coordinate events where activities threaten the security, confidentiality, integrity, and availability of our information, including client information and information systems.

companyName: CRAWFORD & CO

ticker: CRD-A


text: As previously disclosed, the Change Healthcare cybersecurity incident in the first quarter of 2024 disrupted our Company's customers' ability to use Change Healthcare's network connections, thus affecting their insurance claims submissions and billing activities through our systems. Although the Company's information systems were not affected, the cybersecurity incident experienced by Change Healthcare resulted in delay and downtime for our customers. The Company took immediate steps designed to mitigate the impact of the incident for our customers with respect to our solutions.

companyName: Veradigm Inc.


text: Our Board and management recognize the importance of maintaining the trust and confidence of our customers, business partners and employees. The Board provides oversight of our risk management program and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, processes, and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the digital information that we collect and store by identifying and mitigating cybersecurity threats and appropriately responding to cybersecurity incidents if and when they occur.

companyName: Travel & Leisure Co.

ticker: TNL


text: We engaged and used the advice of a third-party consultant to help us assess and identify risks from cybersecurity threats, including the threat of a cybersecurity incident, and manage our risk assessment program. Among other things, these providers have recommended installation of Check Point Firewall and ESET Protect Advanced cloud based anti-virus, as well as site periodic evaluations of the work stations and also engaged third party consultants to prepare policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service providers and we continue to monitor that all third-party software providers remain of the date of this report, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, and cause existing clients/customers to discontinue. As well as prevent us from attracting new clients/customers, and interfere with the progress of our clinical trials, or interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. For further information, see "Risk Factors— Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our cyber-security " in Item 1A of this Annual Report on Form 10-K. We currently do not carry a cyber liability insurance policy, but are evaluating whether to acquire one to mitigate any financial impact of a cybersecurity breach.

companyName: ENvue Medical, Inc.

ticker: FEED


text: Our risk management program also assesses third party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business or customer data.

companyName: TIDEWATER INC

ticker: TDW


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our results of operations or financial condition. However, cybersecurity threats have the potential to significantly impair our operations and the operations of the various third parties upon whom we rely.

companyName: FONAR CORP

ticker: FONR


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We are not currently aware of any known cybersecurity risks that may materially impact our operations and we may not be able to determine the likelihood of such risks. See "Risk Factors - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: Our Board of Directors has risk oversight responsibility for the Company, which it administers directly and with assistance from its committees. The Audit Committee assists the Board in its oversight of the cybersecurity risk management program. The Audit Committee is tasked with reviewing and receiving periodic reports from management regarding the Company's information technology system controls and security and, at least annually, evaluating the adequacy of the Company's information technology security program, compliance, governance processes, training and controls. The Audit Committee specifically oversees: • management's evaluation of the potential impact of cybersecurity risk exposures on the Company's business, financial results, operations and reputation, • the steps management has taken to monitor and mitigate such exposures, • major legislative and regulatory developments that could materially impact such exposure, and • the Company's incident response planning (including escalation protocols), including with respect to the prompt reporting of material cybersecurity threats or incidents to management, the Audit Committee and the Board of Directors.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Through our global security incident management plan, we aim to prevent potential cybersecurity incidents from becoming material with early detection, escalation, mitigation and remediation activities. If a cybersecurity threat is at risk of materially affecting our company, our cross-functional response team will enact our escalation processes to notify appropriate levels of management, along with the executive leadership team, disclosure committee, and Board of Directors, as necessary.

companyName: BALL Corp

ticker: BALL


text: We have implemented a number of cybersecurity risk management processes to assess, identify and manage material risks from cybersecurity threats. We conduct real-time monitoring of our environment for suspicious cyber activity using a variety of security tools and centralized logging systems. In addition, we leverage threat intelligence monitoring to stay updated on emerging cyber threats and vulnerabilities and, utilizing this information, conduct regular vulnerability assessments. Furthermore, we conduct regular penetration tests to simulate real-world attacks and identify weaknesses.

companyName: Ingredion Inc

ticker: INGR


text: Coherent's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners, employees, shareholders and other stakeholders. One of the critical factors in maintaining this trust is by the Board being involved in oversight of the Company's enterprise risk management ("ERM") program, of which cybersecurity represents a critical component. Coherent's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, and the International Standards Organization Risk Management Guidelines (ISO 31000), as well as other applicable industry standards.

companyName: COHERENT CORP.

ticker: COHR


text: Additionally, we periodically review and update our cybersecurity policies, procedures, practices, and response plans considering evolving threats, changes in federal government compliance standards, and emerging commercial best practices, as applicable. We conduct employee training programs on cybersecurity as part of our efforts to mitigate persistent and continuously evolving cybersecurity threats. We have implemented processes requiring that material cybersecurity events, or losses of customer or personal data, are reported to affected parties, applicable regulatory authorities and management, as appropriate. The above cybersecurity risk management processes are integrated into our overall enterprise risk management process.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: Similarly, penetration tests are conducted periodically to expose any vulnerabilities within the deployment environment and/or deployed software; including but not limited to open firewall ports beyond deployment design, use of ciphers deemed insecure etc.

companyName: Crexendo, Inc.

ticker: CXDO


text: We have aligned our cybersecurity risk management program with recognized security frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and ISO standards. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use these frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Stephen G. Crawford, age 60, is Executive Vice President, Methanolysis Operations and Worldwide Engineering & Construction Transformation, with executive responsibility for overseeing methanolysis operations in Kingsport, and leading efforts to strengthen Eastman's engineering processes and disciplines and building capabilities for large projects. Mr. Crawford joined Eastman in 1984 and held leadership positions of increasing responsibility in both the manufacturing and technology organizations. From 2007 until January 2014 he served as Vice President of Global R&D in the AM and AFP segments. He was appointed Senior Vice President and Chief Technology Officer effective January 2014, Senior Vice President, Chief Technology and Sustainability Officer effective October 2019, and Executive Vice President, Manufacturing and Chief Sustainability Officer effective October 2022. Mr. Crawford was appointed to his current position effective January 2025.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: We seek to mitigate cybersecurity risks through a cross-functional approach, including our Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to and remediating cybersecurity incidents as and if they occur.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: Identify Risks and Notify Company of Risks: The Cybersecurity Plan dictates an approach to identify and confirm expected incidents, to determine the severity of the risk and promptly take basic initial containment steps. The Cybersecurity Plan includes notification processes for certain cybersecurity incidents which aim to inform and activate an incident response team consisting of officers and employees at the Company and certain external service providers.

companyName: Verano Holdings Corp.

ticker: VRNO


text: The Company's Director of IT is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our Director of IT has over 15 years of experience in information security positions and holds Master's degree in computer information systems. We also have constituted a cross-functional Cybersecurity Committee, comprised of the Director of IT, along with the Chairman, CFO, Management of Business Operations and Human Resources, which meets regularly to review enterprise-wide cybersecurity matters.

companyName: FGI Industries Ltd.

ticker: FGI


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section in our risk factors under the heading "Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents, loss of data, and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business." which disclosures are incorporated by reference herein.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: We recognize the importance of protecting our critical information technology ("IT") systems and data from material risks from cybersecurity threats. Risk management for cybersecurity threats is integrated into our overall enterprise risk management system. We consider cybersecurity risks alongside other business risks. Our risk management framework includes risk assessments, internal controls, and systems monitoring mechanisms. We have implemented and maintain various processes designed to assess, identify, and manage material risks from cybersecurity threats to our IT systems and critical data, including intellectual property, confidential information, that is proprietary, strategic or competitive in nature, health and medical data, clinical trial data, and personal data ("Information Systems and Data"). Third parties also play a role in our cybersecurity efforts. We engage third-party services to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example through penetration testing, independent audits or consulting on practices to address new challenges. We conduct audits and evaluations of our IT infrastructure, network architecture, and software applications to help us identify vulnerabilities, potential entry points, and areas for improvement. We perform assessments considering principles from the National Institute of Standards and Technology Cybersecurity Framework and by using an external third-party security assessor from time to time.

companyName: SI-BONE, Inc.

ticker: SIBN


text: Our CIO's experience includes over twenty years of experience in risk management and compliance, incident response, crisis management and security architecture and technology integration. Our Cybersecurity Operations Team includes three certified information systems security professionals and their experience includes cybersecurity architecture, engineering and administration together with the development of cybersecurity policies, practices and training.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Our approach to risk management is designed to identify, assess, prioritize, and manage material risk exposures that could impact our ability to execute our corporate strategy and fulfill our business objectives. Cybersecurity is a critical component of our enterprise risk management approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors and the Audit Committee of the Board of Directors (Audit Committee). To identify, assess, prioritize, and manage potential cybersecurity threats, we have integrated the following cybersecurity safety measures and processes into our overall risk management system: • Product Security: We integrate cybersecurity into our systems, applications, and processes so that security is a key aspect of the design process. Our major products undergo a formal review process that includes threat modeling, code and dependency scanning and manual code review to identify and remediate vulnerabilities prior to their final release. In addition, we have introduced robust access management controls to enhance the security of our offerings. • Threat Intelligence and Incident Prevention, Detection, and Response: In the fiscal year ended January 31, 2024, Zuora procured FS-ISAC membership for threat intelligence and proactive cybersecurity incident prevention. We maintain a cybersecurity detection and response program aligned with the National Institute of Standards and Technology's Cybersecurity Framework to enable rapid cybersecurity threat detection and response. Additionally, Zuora established a Governance, Risk, and Compliance Committee (GRC Committee), which includes our Chief Financial Officer (CFO), Chief Legal Officer (CLO), Chief Information Officer (CIO), Chief Information Security Officer (CISO), and an Internal Audit representative, and others as needed, in the fiscal year ended January 31, 2024. We also deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including role-based user and network access controls, vulnerability scanning, security configuration monitoring, intrusion prevention and detection systems, and anti-malware prevention, which we evaluate and seek to improve through vulnerability assessments and cybersecurity threat intelligence. • Incident Management Procedures: To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our Company. We have a well-defined incident response plan that includes procedures and guidelines in the event of a potential Company crisis, including a potential cybersecurity incident that has the potential to materially and adversely impact our customers or business operations. Our guidelines define what is meant by a cybersecurity crisis, identify a core Crisis Management Team that includes our CFO, CLO, CIO, CISO, and engineering and human resource management, establish a basic escalation framework, and create a practical communications protocol. The escalation framework requires that our CEO and Audit Committee (and ultimately, the full Board of Directors) receive prompt notification if there is a reasonable risk of a material cybersecurity incident. Following notification, the Crisis Management Team (along with outside experts as needed) must provide the CEO and the Board of Directors with ongoing updates regarding the cybersecurity incident until it has been remediated.

companyName: ZUORA INC


text: Our products and services are normally classified as EAR 99 by the U.S. government, but our defense customers generally require compliance with the International Traffic in Arms Regulation ("ITAR"). Moreover, our products sold for defense applications are integrated with our customers' products and these customers may provide us with Controlled Unclassified Information (CUI) that requires, safeguarding and dissemination controls in accordance with laws, regulations, or Government-wide policies. Given the nature of our business and the cybersecurity risks we face, we have instituted cybersecurity measures for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats to our internal systems, our products, services and programs for customers, and our supply chain.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: We recognize the critical importance of cybersecurity in upholding the safety and security of our systems, services and data and maintaining the trust of our customers. Cybersecurity risk management is an important part of, and is integrated into, the Company's overall enterprise risk management program. We maintain a cybersecurity risk management program that is designed to identify, assess, manage and mitigate cybersecurity risks and provides a framework for responding to cybersecurity threats and incidents. We regularly assess and update our cybersecurity risk management program and our cybersecurity posture to protect the confidentiality, integrity and availability of the Company's and our customers' infrastructure, resources and information.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: The Chair of the Audit Committee is regularly informed by our CFO of both material and non-material cybersecurity risks and incidents. The full Audit Committee must be notified any time our incident response program has determined that a cybersecurity incident is material or requires reporting to a regulatory body.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: The Partnership has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. The Partnership continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: We maintain a comprehensive cybersecurity program designed to protect both customer data and our proprietary information. Our cybersecurity framework is governed by our Board of Managers and driven by a dedicated Information Security Officer, ensuring that all processes comply with regulatory requirements and industry best practices. This framework is documented in our Cybersecurity Policy and Information Security Program Policy, which outlines the risk management, preventive, detective, and corrective controls we have implemented across the organization.

companyName: MINISTRY PARTNERS INVESTMENT COMPANY, LLC


text: • Third-Party Vendor Security Reviews. Suppliers that have access to, host, or pass sensitive data are subject to a rigorous vendor security review which includes questionnaires, security controls and maturity assessments, inspection of evidence of compliance and remediation or acceptance of items identified during a Risk Assessment. • Vulnerability Management / Patching. Any discovered vulnerability is rated by severity and assigned a timeline for remediation. Patching activities are centrally managed with a focus on the identification, remediation, and analysis and closure of vulnerabilities throughout the vulnerability management lifecycle. • Cybersecurity Incident Reporting. Our incident reporting protocol assists prompt and efficient response to cybersecurity threats. This includes links on our internal site listing globally accessible contact numbers for immediate incident reporting, a user-friendly phishing reporting tool in Outlook, and group email boxes that are monitored 24/7 for incident submissions.

companyName: Cigna Group

ticker: CI


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Further, our cybersecurity program is periodically reviewed by senior members of management and adjusted as needed to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge, and regulations change.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Information security and cybersecurity risk is the risk that the security, confidentiality, integrity or availability of our information and critical information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Cybersecurity attacks and other security breaches can have material adverse impacts on our business. While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. The Bank devotes significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs. However, our facilities and systems, and those of third-party service providers, are still vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. The Company seeks to address cybersecurity risks by implementing a governance structure and processes to assess, identify, manage, remediate, and report cybersecurity risks.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Our management team, including our Global Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: The Director of Cybersecurity has over 20 years of relevant experience and is responsible for managing our cybersecurity program and team, which monitors the day-to-day risks using the approach described above. Material near-term and long-term risks are communicated with senior management and the Board of Directors. The Company's Board of Directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures. While the Board of Directors retains oversight over policy and strategy related to cybersecurity, it has delegated the responsibility for the oversight of the Company's cybersecurity program to the Audit Committee. The Audit Committee is responsible for reviewing and discussing the Company's policies regarding risk assessment and risk management, major accounting risk exposures and the implementation and effectiveness of risk management protocols with respect to information technology security and cybersecurity risks, as well as reviewing material breaches and attacks, as applicable.

companyName: DT Midstream, Inc.

ticker: DTM


text: Our dedicated Information Security Department is comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk, including the processes and procedures to mitigate and implement protective, proactive, and reactive measures to protect us against this risk. Personnel in this department hold a variety of technical certifications relevant to their job functions and engage in continuing education. This department is also responsible for developing, documenting, and approving our technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of our IT assets and data under our control.

companyName: Federal Home Loan Bank of Des Moines


text: The Company employs tools to identify, prevent and mitigate cybersecurity threats and respond to cybersecurity incidents in accordance with our internal cybersecurity policies and controls.

companyName: Farmland Partners Inc.

ticker: FPI


text: The Board of Directors receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Viewbix Inc.

ticker: VBIX


text: e.we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; f.we conduct pre-engagement and recurring reviews of the security controls and security-compliance posture of applicable third-party service providers; g.all employees are required to complete periodic trainings that cover security and privacy best practices and company policies;

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: NeurAxis' Board of Directors is responsible for oversight of cybersecurity risk. The Board receives reporting about NeurAxis' practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from NeurAxis' Chief Regulatory Officer/Privacy Officer and VP of IT/Security Officer.

companyName: Neuraxis, INC

ticker: NRXS


text: We rely on our information technology to operate our business and understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Oil-Dri Corp of America

ticker: ODC


text: Our Board of Directors ("Board") has responsibility for oversight of risk management and, pursuant to the Audit Committee Charter, has delegated to our Audit Committee oversight of our cybersecurity risk management program. The Executive Director of IT provides reports to the Audit Committee at least annually as well as the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external security professionals with the results of those reviews reported to senior management and the Board.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practical through changes or updates to our internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as the cybersecurity risk assessment process and developed an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.

companyName: Banzai International, Inc.

ticker: BNZI


text: For information regarding cybersecurity risks that may materially affect our Company, see "Risk Factors — Risks Related to Our Business and Industry — We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity breaches and data leakage — and — Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation." To date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CareMax, Inc.


text: As cybersecurity incidents occur, the Company's cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, the cybersecurity team assesses, among other factors, safety impact, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.

companyName: GoHealth, Inc.

ticker: GOCO


text: The CISO manages a team of employees, which has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained managed service providers. The CISO brings over 30 years of technology, cybersecurity, and risk management experience from the finance and healthcare industries. His work experience includes the design, implementation, and oversight of control and governance frameworks in complex, hybrid-cloud, and data intensive environments operating in highly regulated entities in the financial services and healthcare insurance industries.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: We maintain a cybersecurity program in alignment with our overall Enterprise Risk Management ("ERM") program. See Part II, Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" contained within this report for additional information on the ERM function. Our Privacy and Information Security Committee, comprised of officers and senior leaders, is responsible for overseeing the development and maintenance of information privacy and security policies and effective operation of our corporate information security and cybersecurity program in compliance with applicable state insurance regulations and other legal and regulatory requirements. This committee is sponsored by and reports directly to our Executive Council, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer, executive vice presidents and certain senior vice presidents reporting directly to the CEO as applicable.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: We conduct periodic risk assessments to identify cybersecurity threats that may affect information systems that may be vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: RxSight, Inc.

ticker: RXST


text: The Cybersecurity Committee, described below, meets as needed, but at least monthly, to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Cybersecurity Committee also considers and makes recommendations to the BancPlus board of directors on the Company's cybersecurity program, including security policies and procedures, security service requirements, and risk mitigation strategies. At least annually, the Cybersecurity Committee conducts a cybersecurity risk assessment that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance the Company's cybersecurity program, including security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to the Risk Committee of the BancPlus board of directors and members of management.

companyName: BANCPLUS CORP


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a cyberattack with significant impact will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Antero Midstream Corp

ticker: AM


text: Our chief information security officer is the senior director responsible for the cybersecurity organization, which has primary oversight of material risks from cybersecurity threats. Our chief information security officer reports to our chief information officer. Our chief information officer is responsible for the overall Information Technology (IT) organization.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: Incident Response Plan To ensure that information security incidents can be recovered from quickly and with the least impact to the company and its customers, the company maintains an Incident Response Policy which is designed to work in conjunction with the Disaster Recover/Business Continuity Plan. The COO is responsible for implementing and maintaining the Incident Response Policy.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Inmune Bio, Inc.

ticker: INMB


text: The Bank maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.

companyName: RBB Bancorp

ticker: RBB


text: We have leveraged the support of a third-party data privacy organization to perform a risk assessment designed to identify, assess, and manage data privacy risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf. This process includes a risk assessment process which is designed to oversee, identify and manage material cybersecurity and data privacy risks associated with systems, services and third parties.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Processes for Monitoring and Mitigating Risks and Incidents. We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include: Continuous monitoring of network traffic and systems for signs of potential threats. Regular vulnerability assessments and penetration testing to identify and address weaknesses. Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption. Employee training and awareness programs to educate staff about cybersecurity best practices. Incident response plans to ensure swift and effective responses to cybersecurity incidents. Software and Vendor Risk Assessments. Vulnerability management solution to prioritize patches based on risk. Privileged account management solutions for administrative access.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, before contracting with certain technology services providers, when possible, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to require these providers to adhere to our security standards and protocols.

companyName: USA Compression Partners, LP

ticker: USAC


text: Our CISO, in coordination with the Management Operational Risk Committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, cross-functional teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our information security incident response plan. Our CISO, through his team and use of accompanying technology, monitors the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Management Operational Risk Committee and/or the Board Operational Risk Committee, as and when appropriate.

companyName: LendingClub Corp

ticker: LC


text: Kodak has implemented various processes designed to help assess, identify and manage risk from cybersecurity threats. Kodak's cybersecurity program follows the structure and objectives of the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework and is designed to satisfy multi-jurisdictional regulatory requirements. Key areas of Kodak's cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our IT security operations and risk management team ("IT Security Team"), led by our Chief Information Security Officer ("CISO"), has first line responsibility for the implementation and operation of our cybersecurity risk management processes. However, this team works together with other internal teams to coordinate efforts, priorities and oversight. These include: o our IT Risk Council (the "Council"), which is comprised of key leaders from stakeholder groups throughout the Company and led by our CISO, and meets monthly to review metrics and discuss risks and recent events;

companyName: EASTMAN KODAK CO

ticker: KODK


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled: If our information technology systems or those third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; material disruption of our product development programs; and other adverse consequences.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee receives reports from our Chief Information Officer. Our Chief Information Officer, who works closely with and supervises our IT team, has overall responsibility for assessing and managing any material risks from cybersecurity threats.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: We have adopted a risk-based strategy to manage cybersecurity risks associated with third parties. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. This includes reviewing the security protocols of key vendors, service providers, and external users of our systems.

companyName: REGENCY CENTERS LP


text: The Company uses third-party service providers to perform a variety of functions throughout its business, such as enterprise resource planning, point of sale, eCommerce, wholesale sales, application providers, and web hosting. The Company has a vendor management program to manage cybersecurity risks associated with its use of these providers. The Company's vendor management program includes completion of a cybersecurity questionnaire and review of the vendor's security program for certain vendors designed to help us evaluate the potential cybersecurity risks associated with its use of the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, its vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and imposition of contractual obligations related to cybersecurity on the provider.

companyName: TerrAscend Corp.

ticker: TSNDF


text: Our Vice President of Information Security is responsible for overseeing the Company's cybersecurity practices. He joined the Company in 2018 and has over 10 years of information security and cybersecurity experience. He has an undergraduate degree from Clemson University, and has obtained professional security certifications and trainings, including the Certified Information Systems Security Professional certification. In his role as Vice President of Information Security, he meets with the Audit and Compliance Committee and Board of Directors each quarter to discuss the Company's cybersecurity risk management program.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Vice President of Information Technology (VP of IT) in conjunction with our managed service provider. The current VP of IT brings over 25 years of experience in IT, having held senior positions in technology management and cybersecurity at publicly traded biotechnology companies. This experience includes spearheading large-scale IT transformations, overseeing the implementation of security frameworks, such as NIST CSF, and developing and maintaining tools and processes to safeguard confidential data. Additionally, the VP of IT has directed comprehensive cybersecurity strategies tailored to the unique challenges of the pharmaceutical industry.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: We engage third parties from time to time that assist us in the identification, assessment, and management of cybersecurity risks. We also engage cybersecurity specialists to complete assessments of our cybersecurity processes, program and practices, including our data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs our overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.

companyName: BGC Group, Inc.

ticker: BGC


text: Management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs that include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Our Director of Information Security is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Director of Information Security, provides guidance, oversight, monitoring and challenging the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and reports directly to the Chief Risk Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are subject to professional education and certification requirements. Our Director of Information Security has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management. Certifications include Certified Information Security Manager ("CISM") and Certified Information Systems Security Professional ("CISSP"), which includes continuing education requirements.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: Our Head of Information Security reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.

companyName: Guardant Health, Inc.

ticker: GH


text: Material Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors-Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships."

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including assessing and managing our material risks from cybersecurity threats. The CISO is a Certified Information Systems Security Professional ("CISSP"), and has over 20 years of experience holding various roles in information technology and cybersecurity. The Audit Committee of our Board of Directors is charged with oversight of cybersecurity matters, including oversight of risks from cybersecurity threats.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Additional information on cybersecurity risks the Trust faces is discussed in Part I, Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Invesco CurrencyShares Australian Dollar Trust

ticker: FXA


text: Our information security program includes development, implementation, and improvement of policies and procedures to safeguard information to help ensure availability of critical data and systems. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our program further includes review and assessment by external, independent third parties, who assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. With the assistance of one such reputable third party, the Company conducts biannual maturity assessments of its IT Systems against the National Institute of Standards of Technology (NIST) Cybersecurity Framework. We also carry insurance that provides protection against the risks from cybersecurity threats. To our knowledge, during fiscal 2023, there were no material cybersecurity incidents or threats that materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: Dorman Products, Inc.

ticker: DORM


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is part of our risk management process. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the Center for Internet Security ("CIS") Critical Security Controls.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; penetration testing firms; darkweb monitoring services; and managed detection and response providers.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our Board of Directors are part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: The board receives regular reports from Ms. Randis concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board also receives various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Gamida Cell Ltd.


text: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner. Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities. Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date. However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future. See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program on information security. He is also responsible for keeping HGV apprised of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery. The ISGC, as a whole, consists of information security professionals with varying degrees of professional education, certifications and experience. This blend of diverse qualifications, certifications, and experience within the ISGC ensures a comprehensive and flexible approach to information security, positioning the Company to address emerging threats and maintain a robust defense against potential risks.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The threats to network and data security are increasingly diverse and sophisticated. Despite our efforts and processes to prevent breaches, our devices, as well as our servers, computer systems, and those of third parties that we use in our operations are vulnerable to cybersecurity risks, including cyber-attacks such as viruses and worms, phishing attacks, denial-of-service attacks, physical or electronic break-ins, employee theft or misuse, and similar disruptions from unauthorized tampering with our servers and computer systems or those of third parties that we use in our operations, which could lead to interruptions, delays, loss of critical data, unauthorized access to user data, and loss of consumer confidence. In addition, we may be the target of email scams that attempt to acquire personal information or company assets. Despite our efforts to create security barriers to such threats, we may not be able to entirely mitigate these risks. Any cyber-attack that attempts to obtain our or our users' data and assets, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could adversely affect our business, operating results, and financial condition, be expensive to remedy, and damage our reputation. In addition, any such breaches may result in negative publicity, adversely affect our brand, decrease demand for our products and services, and adversely affect our operating results and financial condition.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: Board of Directors and Board Committees. In accordance with our Corporate Governance Guidelines, the Board of Directors, both directly and through its committees (including the Risk Committee) oversees the proper functioning of our risk management process. In particular, the Risk Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with the Company's business and operational activities and to administer the Company's various compliance programs, in each case including data privacy and cybersecurity concerns. The Board and the Risk Committee each meet at regularly scheduled and special meetings throughout the year at which meetings management reports to the Board concerning the results of its risk management activities, as well as external factors that may change the levels of business risk to which we are exposed. Specifically, the Risk Committee receives regular updates from members of the InfoSec Committee or Ethics Committee, as often as necessary but at least once per year, with respect to our cybersecurity threats and responses to any cybersecurity incidents.

companyName: EXELIXIS, INC.

ticker: EXEL


text: As a corporation committed to maintaining the integrity, confidentiality, and availability of our digital assets and sensitive information, the Company recognizes the critical importance of cybersecurity in today's interconnected business landscape. The Company's cybersecurity measures are designed to safeguard our systems, networks, data, and information from unauthorized access, disruption, or misuse.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: We rely on our vendors and other third parties, including the continued availability of their products and services, to conduct business and provide services to our clients. A cybersecurity incident at a vendor or other third party could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity questionnaire and a review of independent cybersecurity rating assessments. Our contracts with third parties generally include security and privacy addendums where applicable and require counterparties to meet a specific standard of data security and report cybersecurity incidents to us.

companyName: ASSURANT, INC.

ticker: AIZ


text: e. Incident Response Preparedness: Our incident response plan outlines our approach to addressing and responding to cybersecurity incidents and to findings, vulnerabilities and incidents that could lead to or allegedly be suspected as cybersecurity incidents.

companyName: KALTURA INC

ticker: KLTR


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: If and when the Company completes a merger or other acquisition, the board of directors and management will assess the risks of cybersecurity threats to its business adopt processes for assessing, identifying and managing risks from cybersecurity threats as warranted.

companyName: DEEP FISSION, INC.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, contract research organizations and contract manufacturing organizations. We have vendor management processes to identify and oversee cybersecurity risks associated with the use of our providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, these processes may include a risk assessment of the vendor, security questionnaire, security assessments, security assessment calls with the vendor's security personnel and imposition of contractual obligations on the vendor.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: The audit committee of our Board of Directors provides oversight of cybersecurity risks. It receives regular reports from management, including our General Counsel, on various cybersecurity matters during each board meeting. Such reports include information on current cybersecurity risks facing the organization, cybersecurity incidents involving our partners and/or other participants in our industry, and routine updates on the status of our internal cybersecurity risk management plan.

companyName: FONAR CORP

ticker: FONR


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at QVC. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: QVC Group, Inc.

ticker: QVCGA


text: The full Board is collectively responsible for oversight of cybersecurity matters and is updated at every Board meeting. In these updates, the Company's management and the Investment Adviser's CISO provide reports on key metrics such as vulnerability scan results, third-party risk assessments, and incident response readiness. The Board also ensures its members receive periodic training or engage external advisors with cybersecurity expertise to strengthen oversight capabilities.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Board Oversight of Cybersecurity Matters security matters is the responsibility of our Audit Committee. The Audit Committee meets with the senior executives, specifically the Chief Executive Officer and Chief Financial Officer on at least an annual basis to discuss cybersecurity posture. The Audit Committee may also periodically receive targeted briefings related to cybersecurity and reviews our incident response capabilities.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of our Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the Nation's critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an evolving landscape.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: This proactive surveillance allows us to address threats swiftly, mitigating any possible impact on our operations and clients. Semi-annually, we leverage third-party independent consultants to perform penetration and segmentation testing of our internal and externally facing environments. The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader risk assessment that is presented to our Board, Audit Committee, and members of management.

companyName: Paysign, Inc.

ticker: PAYS


text: The governance of cybersecurity risks is a critical function of our Board of Directors which has a key role in the oversight of cybersecurity and related technology risks. The Board of Directors is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.

companyName: NKGen Biotech, Inc.


text: As with all institutions involved in the provision of financial services, information security represents a significant operational risk. To mitigate this risk, we have developed and manage a comprehensive information security program dedicated to protecting data entrusted to us by our clients as well as our own proprietary corporate information and the information technology infrastructure we use to process this data and information. Our approach is considered to be a defense-in-depth strategy, with multiple tiers of security controls and monitoring. Our security program is benchmarked against the National Institute of Standards and Technology Cybersecurity Framework (NIST), including, among other things, with respect to application security, vulnerability management and data protection, threat detection and incident response.

companyName: Essent Group Ltd.

ticker: ESNT


text: The Company has also designed its information technology systems and infrastructure to protect its and its customers' data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company's operation of cardholder data environments. The Company's cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.

companyName: CoreCard Corp

ticker: CCRD


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors, which is responsible for monitoring and assessing strategic risk exposure, has delegated primary oversight responsibility for cybersecurity to our audit committee.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO