text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors –Cyberattacks, data breaches or other compromises to our or our critical third parties' systems, data, products or services could have a material adverse effect on our business.

companyName: Spok Holdings, Inc

ticker: SPOK


text: Our cybersecurity risk management process is a standalone process, but it is integrated with and informs our overall enterprise risk management program.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI

secItem: Item 1C


text: Through a multi-functional coordinated effort, we assess and mitigate cybersecurity risks across our business units based on likelihood of the risk and potential impact to the business unit, the Company, and our stakeholders. These risks are identified using tactical, operational, and compliance-based approaches. Risks and associated consequences, should they materialize, are evaluated using likelihood of occurrence considering existing controls and technologies.

companyName: Talen Energy Corp

ticker: TLN


text: We are not aware of having experienced any material cybersecurity incidents in 2024. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.

companyName: SOLESENCE, INC.

ticker: SLSN


text: Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using: (i) industry standard information security measures prescribed for use by NIST; (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) Sarbanes-Oxley and SSAE 18/ISAE 3402; (iv) privacy regulations such as the GDPR and the CCPA; (v) business continuity management measures aligned with the ISO/IEC 22301 standard; and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.

companyName: Fortinet, Inc.

ticker: FTNT


text: We more fully describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A. of this Form 10-K. See the risk factors captioned "We may experience difficulties in managing our growth and expanding our operations," "We are subject to cybersecurity risks to our and our suppliers' operational systems, security systems, infrastructure, integrated software in our LiDAR solutions and customer data processed by us or third-party vendors or suppliers and any material failure, weakness, interruption, cyber event, incident or breach of security could prevent us from effectively operating our business" and "Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which we operate may adversely impact our business, and such legal requirements are evolving, uncertain and may require improvements in, or changes to, our policies and operations."

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Our Chief Compliance Officer, Chang Kim, is responsible for overseeing the development, implementation, and ongoing management of the Fund's Cybersecurity Policies and Procedures including the monitoring of our systems for potential cybersecurity events and the implementation of preventive and mitigative measures.

companyName: VS Trust

ticker: SVIX


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Our ITRM program also includes processes to identify, assess and oversee risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: RADIUS RECYCLING, INC.


text: The Company contracts with third parties to periodically conduct penetration testing. The Company's internal audit team also periodically conducts a risk-based cybersecurity audit and, as part of such audit, engages third parties to conduct detailed security assessments, including adversary simulations, technical remediation validation and reporting of results. The Company's internal audit team prepares cybersecurity audit reports in accordance with appropriate standards and reports findings and recommendations to Company management. The audit reports and management's responses, including descriptions of any corrective actions taken, are then reported to the Audit Committee and the Board of Directors. Cybersecurity threats, possible security events, and ongoing security enhancement initiatives are regularly discussed and tracked with the CIO, VP of Cybersecurity, and other senior IT team members through regularly scheduled, collaborative meetings and more frequently as the subject matter merits. Preventative security measures are shared with Management through regularly scheduled IT steering committee meetings. The Audit Committee is apprised of cybersecurity controls, known and perceived risks, remediation of those risks, and other measures via the Chief Audit Executive, through direct briefings, or in writing (by the CIO and/or designee). Our incident response policy/plan requires that key Company executives and the Audit Committee are informed of and involved with any confirmed cybersecurity incident (including mitigation/remediation). Company IT acceptable use policies require that employees report any security incidents to IT and his/her supervisor. Regularly scheduled Company training courses and security bulletins reinforce security awareness.

companyName: SAUL CENTERS, INC.

ticker: BFS


text: Our information technology group monitors the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. We have implemented and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we are equipped with a defined and practiced incident response plan, which includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: LGI Homes, Inc.

ticker: LGIH


text: Our Board has responsibility for the oversight of risk management and, throughout the year, discusses and receives reports on our strategic plan and the risks faced by the Company. The Board has delegated to the Nominating and Corporate Governance Committee of our Board responsibility for reviewing that Board oversight of key risks is appropriately handled by the full Board or delegated to a committee. The Audit Committee of the Board has the responsibility to provide oversight relating to the information security program and cybersecurity risks. Our Senior Vice President, Information Technology, provides briefings to the Audit Committee regularly, typically quarterly, on our information security program's performance and the changing risk environment, including detection, mitigation, and response to cybersecurity incidents. The Audit Committee regularly provides updates to the Board on its activities, including its review of cybersecurity matters. Additionally, our IRP contemplates that the Audit Committee, and, if appropriate, the full Board would receive prompt and timely information about cybersecurity incidents that meet established thresholds under our IRP.

companyName: Sovos Brands, Inc.


text: The Board of Directors, acting directly and through its committees, is responsible for the oversight of our risk management programs. The Board's Audit Committee has the delegated responsibility for the oversight of key enterprise risks, including risks from cybersecurity threats. The committee also provides oversight of our policies and processes for monitoring and mitigating such risks. Among other duties, the Audit Committee receives and reviews periodic reports from management pertaining to cybersecurity programs and data protection controls, as well as other information security reports that the committee deems appropriate. The committee meets at least quarterly, and the chair of the committee gives regular reports to the full Board of Directors on its activities.

companyName: CLARIVATE PLC

ticker: CLVT


text: At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters. Additionally, at two meetings each year, management includes additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department. The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer and Senior Director of IT and Security. Such individuals have over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: NETLIST INC

ticker: NLST


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. We seek to contractually require third party service providers with access to our information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to us, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel our service providers to notify us of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: With respect to assessing privacy, data and cybersecurity risks, the Company adopts a hybrid approach that primarily aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, including the guidance set forth in the NIST HIPAA Security Rule Cybersecurity Guide, while also evaluating against certain elements of the ISO 27001 and 27005 standards that management believes provide additional levels of guidance or structure. We regularly evaluate the Company's cybersecurity and privacy processes and procedures, both through regular audits by our Internal Audit and IT security teams, as well as regular retention of outside advisors under direction of our IT security team. Among other things, the IT security team oversees an external third party review at least every two years that evaluates the readiness of the entire Company against the NIST Cybersecurity Framework and provides an assessment that measures Capability Maturity Model Integration levels. Additionally, our CISO engages in regular consultations, typically monthly, with third-party cybersecurity advisors. Among other things, these sessions provide the Company with a broader review of the external cybersecurity environment, helping us to stay current on emerging or developing security approaches and risks. Among other initiatives, our CISO and the Company's IT security team have actively participated in industry conferences and maintain memberships to resources such as the Health Information Sharing and Analysis Center (Health-ISAC), a trusted community of critical infrastructure owners and operators within the Health Care and Public Health sector which, among other things, allows the Company to monitor email updates and alerts coordinated with the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. In order to maintain awareness of privacy, data and cybersecurity risks, the Company incorporates these topics into its annual compliance training materials that are mandatory for all teammates and new hires, and among other things cover HIPAA privacy and security requirements.

companyName: DAVITA INC.

ticker: DVA


text: Our reliance on third-party service providers, who manage their own IT security, introduces additional vulnerabilities. These providers play a crucial role in securely handling and storing our sensitive data. Despite setting specific security requirements, we do not control their cybersecurity investments or operational security. Any security lapses on their part could potentially disrupt their services and, by extension, negatively impact our financial health and operational efficiency.

companyName: Crypto Co

ticker: CRCW


text: Incyte's Chief Information Security Officer (CISO) runs our cybersecurity program. Our CISO, who holds numerous cybersecurity and related certifications, including Certified Information Systems Security Professional, reports in to our Chief Information Officer (CIO). Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. They regularly report directly to the Audit and Finance Committee or the Board of Directors on our cybersecurity program and our efforts to prevent, detect, mitigate and remediate cybersecurity incidents. In addition, we have an escalation process in place to inform senior management and the Board of Directors of any material issues as they arise.

companyName: INCYTE CORP

ticker: INCY


text: Although we take cybersecurity risks seriously, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: HEALTHY EXTRACTS INC.

ticker: HYEX


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: Interim Chief Executive/Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: The Company implements cybersecurity policies and controls within acquired entities as part of its integration process over time, typically in a phased approach, and with time periods for full execution varying depending on multiple factors, including the size and geographic scope of the acquired entity's operations; the status of the acquired entity's security including security systems, tools and personnel; security risks within the acquired entity; and the availability and quality of any interim defenses which can be implemented to protect both the Company and the acquired entity or to prevent threats at the acquired entity from reaching the Company's systems. Cybersecurity is also part of the Company's acquisition due diligence to identify risks and interim remedial measures for prioritization and implementation near transaction closing, subject to antitrust rules. In addition to the Company's active monitoring of certain critical third parties for cybersecurity threats and attacks, the Company also has certain critical third parties who access its information systems subject to controls designed to mitigate risks from cyber-attacks originating within infected third-party information systems. Moreover, the Company conducts diligence of certain of its third-party service providers with attention to cybersecurity risks.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: The CIO typically provides the Audit Committee with cybersecurity updates on a quarterly basis. During such updates, the CIO generally covers topics such as data security positions, results from third-party assessments, our incident response plan, and any material cybersecurity threats and developments. In 2024, the CIO reported to the full Board of Directors on the Company's cybersecurity programs and risk mitigation efforts.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: Bandwidth Inc.

ticker: BAND


text: In addition, as part of our cybersecurity risk management program, we have processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers, and our cybersecurity risk management program takes into account third-party systems through which we could be impacted by the compromise of the security of a third-party service provider. In this regard, we conduct due diligence on third-party service providers with respect to cybersecurity risks prior to entering into relationships with them, and we regularly assess security risks associated with our use of third-party service providers, including onboarding contract employees through the same process we onboard our own employees. In addition, we contractually require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations, and we continuously track mission critical vendors using a third-party monitoring service.

companyName: Mid-America Apartments, L.P.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section Governance Related to Cybersecurity Risks

companyName: Cannaisseur Group Inc.

ticker: TCRG


text: The Board reviews and evaluates the organization's effectiveness to manage cybersecurity threats. The SVP of Information Technology, the General Counsel, and the CEO are responsible for reporting and communicating cybersecurity threats that have material impact on the organization to the Board. The Board regularly reviews the organization's risk posture and provides guidance to minimize or mitigate risk.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: We rely increasingly on software applications, data transmissions and cybersecurity safeguards provided by or in conjunction with third parties to maintain our cybersecurity posture and evolve with the threat environment. We engage third party resources to assess our procedures, test safeguards, provide training and monitoring, and assess our vulnerabilities. We evaluate third party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and data security standards.

companyName: Air Transport Services Group, Inc.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Executive Officer or Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings.

companyName: Vyome Holdings, Inc

ticker: HIND


text: The Company's cybersecurity strategy is guided by risk priorities and identified areas for improvement, which are informed by regulatory requirements and industry standards, such as the Federal Trade Commission's Safeguards Rule and the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and evolving business needs. This strategy is shared with the executive leadership at least annually. The Company maintains an incident response plan, coupled with a continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes to support teams, senior leadership, and the Board.

companyName: Dave Inc./DE

ticker: DAVE


text: The Company's information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: Our Board of Directors has oversight responsibility for the ERM program, and delegates the risk management assessment and risk management approach, including risks related to cybersecurity, to its Audit Committee. Among other responsibilities, the Audit Committee is responsible for monitoring internal controls, including those related to cybersecurity risk.

companyName: STERIS plc

ticker: STE


text: The Company has adopted processes designed to assess, identify, and manage material risks from cybersecurity threats that are integrated into the Company's overall risk management system. The Company's cybersecurity risk management processes are managed by Tuearis Cyber ("Tuearis") an outside contractor with significant experience and expertise in designing and implementing cybersecurity programs for corporate entities such as the Company.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: The Board of Directors is responsible for general oversight of the Company's risk management program, including cybersecurity risks. The Board of Directors receives an annual report from senior management through the ORM program and material risk assessments and mitigation strategies, including with respect to cybersecurity risks.

companyName: OSHKOSH CORP

ticker: OSK


text: Governance of Cybersecurity Risk Management Our board of directors, as a whole, has oversight responsibility for Charles River's strategic and operational risks. The Audit Committee of the Board of Directors has been delegated by the Board responsibility by reviewing and discussing Charles River's risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically discusses its review and assessment with the board of directors.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: CarMax's cybersecurity program is designed to help ensure the proper assessment, identification, and management of the company's risks from cybersecurity threats and is integrated into our overall risk management system. The company's cybersecurity program is staffed by well-trained and experienced cybersecurity professionals and includes technology controls, proactive identification of data security vulnerabilities, and quarterly, or as needed, reporting by management to the Technology and Innovation Committee of the Board of Directors (the "Board").

companyName: CARMAX INC

ticker: KMX


text: Our CISO has over 20 years of experience in information security and global compliance. The CISO reports directly to our Senior Vice President of Information Technology and Engineering, who provides oversight of cybersecurity, risk, mitigation strategies, and governance.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: The Bank's Enterprise Risk Committee annually reviews and approves the Bank's Information Security Policy. The Bank's Information Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulation, the Gramm-Leach-Bliley Act and the interagency guidelines issued thereunder, and applicable laws. The Bank develops mitigation plans, monitors tactical implementation of the policy, and engages in detailed risk assessments comprising the Bank's Information Security Program overseen by the Bank's Enterprise Risk and Technology & Operations Committees. The Bank's Enterprise Risk and Technology & Operations Committees report to the Board.

companyName: Federal Home Loan Bank of San Francisco


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • an internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • periodic cybersecurity training for our workforce.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Cybersecurity risk oversight is a responsibility of the Board of Directors. The Board of Directors, through the Audit Committee, provides oversight for matters related to the security of information technology systems and procedures, including data privacy and cybersecurity and related risks.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: Our cybersecurity infrastructure includes a combination of technical, administrative and physical safeguards designed to mitigate cybersecurity risks. As part of our risk management process, the CFO also regularly engages with the outside IT consultants to review and minimize the Company's cyber risk.

companyName: BAB, INC.

ticker: BABB


text: There can be no guarantee that our policies and procedures will be effective. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A - Risk Factors for additional discussion of our cybersecurity risks. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, including the 2018 malware incident, have not materially affected our results of operations or financial condition, including our business strategy, for the periods covered by this Annual Report on Form 10-K, and we do not believe that such risks are reasonably likely to have such an effect over the long term.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: The Company's Chief Information Officer has formal education in information technology and extensive experience over 20 years working in and leading information systems and technology functions. Our Chief Information Officer receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.

companyName: Kimball Electronics, Inc.

ticker: KE


text: We emphasize that everyone has a role to play in data security. All employees are provided with data security and privacy training upon hire and as part of annual refresher training. All employees are required to complete this training, and we also provide periodic updates and guidance related to cybersecurity. In addition, we regularly conduct phishing simulations or other tests to identify cyber threats.

companyName: Pennant Group, Inc.

ticker: PNTG


text: •24/7 Security Operations Center, • advanced endpoint detection and response, • user behavior analytics, • vulnerability identification and patching, • email threat prevention, • data loss prevention, • identity and privileged access management, and • ongoing phishing training and testing.

companyName: BELDEN INC.

ticker: BDC


text: Since at least January 1, 2022, we are not aware of any cybersecurity incidents that have materially affected the Company. Based on our current understanding of the cyber risk environment and our preparedness level, we do not believe it to be reasonably likely in the near term that a cybersecurity threat will materially impact our business strategy, results of operations or financial condition. Nonetheless, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – The unauthorized access, use, theft or destruction of tenant or employee personal, financial or other data, or of Regency's proprietary or confidential information stored in our information systems or by third parties on our behalf, could impact operations, and expose us to potential liabilities and material adverse financial impact."

companyName: REGENCY CENTERS LP


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our chief technology officer, or CTO, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current CTO has over 30 years of experience in information technology and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CTO provides periodic updates on our cybersecurity risk profile to management and the audit committee of our board of directors.

companyName: Semler Scientific, Inc.


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee reviews comprehensive risk assessments of the Company's information technology, privacy, and cybersecurity programs annually and receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: We assess, at least annually, the technological risks to our key IT systems and information. We have implemented controls to identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an understanding of access controls, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: We have implemented cybersecurity controls to detect and address threats arising from our use of third-party service providers. Security risk assessments are conducted during onboarding, contract renewal, and when an increased risk profile is identified. We also require specified security controls and other responsibilities from our service providers and we investigate security incidents affecting them as deemed necessary.

companyName: Match Group, Inc.

ticker: MTCH


text: If there is a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems may allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information. Though we take steps to ensure our products and/or software are secure, it is possible that a cybersecurity incident could result in the loss or compromise of critical data. If a guest alleges that a cybersecurity incident causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and regulatory repercussions. A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. See Item 1A. Risk Factors— Business, Economic, Market and Operating Risks—Failure to maintain the integrity of our internal or customer data, including defending our information systems against hacking, security breaches, computer malware, cyber-attacks and similar technology exploitation risks, could have an adverse effect on our results of operations and cash flows, and/or subject us to costs, fines or lawsuits.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: We have identified and as a result monitor cybersecurity as an enterprise risk of the Company. We have an Information Security Steering Committee that meets quarterly to review the cybersecurity threat landscape, current risks, incidents and program management. We routinely assess the cybersecurity threat landscape, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: As an externally managed company, we rely on TPG's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an enterprise risk committee ("ERC") to manage overall risk, including cybersecurity risks identified by the cybersecurity team. The ERC includes representatives from relevant functions and is led by TPG's chief executive officer. TPG has also established an operational risk committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of TPG's risk management, control and governance processes is assigned to TPG's chief information security officer, who reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with TPG's chief information officer, reports to the ERC at least annually. TPG's chief information security officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact TPG and the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. TPG's chief information security officer and TPG's chief information officer each have more than 20 years of experience in their fields. TPG's chief information security officer and other senior members of TPG's cybersecurity team hold industry standard certifications.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: In addition, as part of its risk management strategy, Voya has an established and integrated cybersecurity incident response plan that focuses on incident detection, management and response. The information security team periodically reviews and updates the plan and tests playbooks within the plan through tabletop exercises.

companyName: Voya Financial, Inc.

ticker: VOYA


text: We leverage common and widely accepted external cybersecurity risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity framework, to assess, guide, and enhance our cybersecurity posture. Our program effectiveness is measured through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures on the effectiveness of our cybersecurity controls across core National Institute of Standards and Technology Cybersecurity framework functions (Govern, Identify, Protect, Detect, Respond, and Recover), our ability to manage first- and third-party cybersecurity events and incidents, cybersecurity incident response exercises, results of our recurring internal assessments, vulnerability assessments, penetration tests, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control design and implementation, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee.

companyName: AMEREN CORP

ticker: AEE


text: CISO, in his capacity, regularly informs the Chief Financial Officer and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the senior management team is kept abreast of the cybersecurity posture and potential risks facing Horizon. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: With oversight from our board of directors, the Audit Committee is primarily responsible for assisting the board in fulfilling its oversight responsibilities relating to risk assessment and management, including cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks relating to cybersecurity threats.

companyName: Zeo Energy Corp.

ticker: ZEO


text: The Committee is the primary oversight body to monitor the Company's cybersecurity and related information technology risks and receives periodic updates from Company management (including, the Chief Information Officer and the CISO) on the Company's policies, processes, procedures, and any significant developments related to the identification, mitigation, and remediation of cybersecurity risks. The Chair or Vice-Chair of the Committee meet as necessary with the Chief Information Officer and the CISO to engage in a more detailed review of the Company's cybersecurity and information security activities. The Committee charter also requires that the Committee ensure that Company management provides an annual cyber and information security update to the full Board. Current Committee members are: Zsolt Harsanyi, Ph. D., Sujata Dayal and Kathryn C. Zoon, Ph. D., all of whom are independent directors.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: We have a unified and centrally-coordinated team, led by our Chief Financial Officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across the Company. In addition, we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: AMERICAN BATTERY TECHNOLOGY Co

ticker: ABAT


text: Reporting to Board of Directors The CISO regularly informs the CFO of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, which has oversight and may provide guidance on critical cybersecurity issues.

companyName: electroCore, Inc.

ticker: ECOR


text: A security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors – "We face risks associated with cyber-attacks, cyber intrusions, or otherwise, which could pose a risk to our systems, networks, and services" and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer." and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: CENTERSPACE

ticker: CSR


text: To help mitigate this risk, Radian has designed and maintains an Information Security Program that is intended to protect our corporate data as well as data entrusted to us by our customers and partners. The Information Security Program is built on a risk-based approach that identifies and prioritizes cyber threats based on their potential impact on our strategy, operations, and assets. This program is aligned with our enterprise risk management program, extends across business lines and encompasses written policies on cybersecurity.

companyName: RADIAN GROUP INC

ticker: RDN


text: To ensure that cybersecurity is an organization-wide effort, we provide mandatory cybersecurity training at least annually for all employees with network access, including training designed to simulate and help prevent phishing and other social engineering attacks. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.

companyName: WELLTOWER INC.

ticker: WELL


text: With respect to our software platforms that are hosted by third parties, we utilize an external vendor risk management platform is utilized to evaluate, rate, monitor and track vendor risk. The security practices and processes of the service providers are monitored regularly, and periodic audits are performed on the security adequacy and compliance of the service provider. For any of our hosted applications we require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third party providers is part of our overall cybersecurity risk management framework.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: AEMETIS, INC

ticker: AMTX


text: The Company's Vice President of Information Systems has been with the Company for over 18 years and has overseen the Company's information systems, including its cyber risk management program, for the last five years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: EPR PROPERTIES

ticker: EPR


text: Our Chief Executive Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: IMMUNIC, INC.

ticker: IMUX


text: Cybersecurity risks are classified as a Tier 1 risk within our enterprise risk management program. We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement numerous cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, detailed incident response plans, and other advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate insider threats. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations. In some instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Our COO, together with our internal IT team, are responsible for assessing and managing cybersecurity risks. They review at least quarterly with our expert advisors our cybersecurity measures and procedures in view of the Company's cybersecurity risks to anticipate future threats and trends, and determine whether and how to adjust our strategies and processes accordingly. During the year ended December 31, 2023, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We depend on data and our information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."

companyName: NextCure, Inc.

ticker: NXTC


text: Management's Role Managing Risk The CISO advises the Enterprise Risk Management Committee (the "ERM Committee") of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis: • Company threat profile and emerging threats; • Status of cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Board and Management Oversight of Risks Associated with Cybersecurity Threats The Technology Committee provides the board of director-level oversight of our information technology and information security practices and cyber-risk profile and serves as a liaison between our board of directors and the CISO with respect to such matters. The Technology Committee reviews our key initiatives and practices relating to information technology, information security, cybersecurity, disaster recovery, business continuity, data privacy and data governance, and monitors compliance with regulatory requirements and industry standards. The Technology Committee helps to ensure that our strategic business goals are aligned with our technology strategy and infrastructure and that management has adequate support for our internal technology and information security needs.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Board's Audit Committee. The Audit Committee discusses with management not less than annually our major financial risk exposures, including those related to data privacy, data security and network security, and management's program to monitor, assess and control such exposures, including our risk assessment and risk management policies. The Audit Committee reports to the Board as necessary with respect to its activities, including making such reports and recommendations to the Board as it deems necessary and appropriate.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, see Item 1A, "Risk Factors", above.

companyName: CADIZ INC

ticker: CDZI


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, encryption and authentication technology and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.

companyName: Cardlytics, Inc.

ticker: CDLX


text: Our Board of Directors and management prioritize cybersecurity. Although our full Board of Directors is generally responsible for cybersecurity risk management, it has assigned principal oversight responsibility of risks from cybersecurity threats to our Audit Committee. As described above, management is also responsible for assessing and managing risks from cybersecurity threats, and designated management personnel, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary meet quarterly as a Risk Committee to determine cybersecurity matters to be shared with the Audit Committee. The Risk Committee provides the Audit Committee updates on such matters on at least a quarterly basis. The Audit Committee reports cybersecurity risks to the full Board during quarterly meetings.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, associates and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Senior Director and Head of Information Technology who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: Management Personnel Our internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Chief Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: We may not be able to detect, prevent, or respond to all cybersecurity risks and threats in a timely or effective manner. We may also incur significant costs and liabilities as a result of any cybersecurity breaches or incidents, such as legal claims, regulatory fines, remediation expenses, reputational damage, loss of business opportunities, or competitive disadvantage. We may also face litigation, investigations, or enforcement actions by governmental authorities, customers, shareholders, or other parties arising from any cybersecurity breaches or incidents.

companyName: TELIX QSAM INC.


text: We regularly conduct table-top simulation exercises to test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions.

companyName: FEDEX CORP

ticker: FDX


text: Our management team, including our Sr. Director, Information Technology Operations and Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of security management in the Financial & Life Sciences industries.

companyName: 4D Molecular Therapeutics, Inc.

ticker: FDMT


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer ("CISO") who has a CISO executive certification from the Heinz College at Carnegie Mellon University, a bachelor's degree in Electrical Engineering, over a decade of information security leadership, and over twenty years of consolidated IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework to communicate with and include executive leadership, outside counsel and the Board of Directors, as appropriate. The Impact Assessment Committee works with the Company's internal and external legal counsel to determine and facilitate appropriate communications with the Board of Directors.

companyName: Sandisk Corp

ticker: SNDK


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer and the Senior Director of Information Security.

companyName: Warby Parker Inc.

ticker: WRBY


text: The Company's processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of the Company's systems and network for cybersecurity events; • Regular testing of the Company's Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for team members with access to Company email, as well as tailored training for team members in more sensitive roles. Periodic testing to ensure the security training is effective.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks The information and operational technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. In the normal course of business, we may collect and store certain sensitive information of the Partnership, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party and employee information, and certain personally identifiable information.

companyName: USA Compression Partners, LP

ticker: USAC


text: The Risk Committee of the Board of Directors is ultimately responsible for oversight of risks from cybersecurity threats, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted.

companyName: BankUnited, Inc.

ticker: BKU


text: Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company's Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security's list of Prohibited Nations to further protect the Company's supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology. Our existing insurance limits may be inadequate to cover a material cyber incident. This could expose us to potentially significant claims and damages.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: The Company also maintains a robust firewall system and firewall management program to restrict inbound and outbound network traffic. A dedicated team of network engineers manages firewall rulesets and monitors firewall health and alerting.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: We and our third-party administrators, vendors and partners are also subject to ongoing cybersecurity threats. While we cannot guarantee that these threats will not have an adverse impact on us, we do not believe such threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: MKS INC

ticker: MKSI


text: The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: RYTHM, Inc.

ticker: RYM


text: Exela has developed and maintained a comprehensive cybersecurity program which is integrated within Exela's enterprise risk management program and encompasses the corporate and operational technology environments, as well as client-facing products and services. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity incidents and risks within an ever-changing threat landscape. We utilize cybersecurity policies and frameworks based on industry and government standards, including the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Exela Technologies, Inc.

ticker: XELA


text: We rely upon information technology (IT) networks and systems to process, transmit and store electronic information, and to manage or support a variety of critical manufacturing and business processes or activities. Additionally, we and certain of our third-party vendors collect and store personal or confidential information, including personally identifiable information, in connection with human resources operations and other aspects of our business. The secure operation of these information technology networks and systems and the proper processing and maintenance of this information are critical to our manufacturing and business operations.

companyName: Dauch Corp

ticker: DCH


text: The Board of Directors plays an active role by meeting periodically to review the status of the organization's the information security program and roadmap for new cybersecurity risk management initiatives.

companyName: CXApp Inc.

ticker: CXAI


text: Company has implemented stringent security assessments before engagement and ongoing monitoring throughout partnerships to address risks associated with third-party service providers. We've also enhanced our contractual requirements to align third-party security practices with our standards.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: The cybersecurity department of the Bank's Information Technology (or IT) department is responsible for the day-to-day operations of our cybersecurity controls and defenses. The department is managed by the Bank's Director of Information Systems and Security, who reports to the Bank's Chief Technology Officer. The current Director of Information Systems and Security has more than 24 years of technology and cybersecurity experience. Our Chief Technology Officer periodically reports information about the Company's cybersecurity risks and operational developments to our Board of Directors.

companyName: Finwise Bancorp

ticker: FINW


text: Identifying and assessing cybersecurity risk is fully integrated into our overall risk management systems and processes. The Company has established a cybersecurity and information security program that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. Our security program under this framework utilizes policies, software, training programs and hardware solutions to protect and monitor our environment, including multi-factor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing and identity management systems.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Cybersecurity Insurance Coverage Our internal cybersecurity risk management processes are supported by cybersecurity insurance that we have secured through industry leading underwriters. We believe that our cybersecurity insurance provides sufficient coverage to protect our assets, operations, and our employees from the financial impact of any cyber-attacks.

companyName: Orion Group Holdings Inc

ticker: ORN


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based, threat-informed approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are evaluated and prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk or threat. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity program also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO" and, together with the CIO, the Company's "Cybersecurity Leaders") and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Additionally, in order to reduce cybersecurity risk related to the use of third-party service providers, we (i) obligate our service providers to adhere to privacy and cyber security measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is then ranked in a tier, which tier determines the frequency and extent of evaluation for the service provider. We additionally collect SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents from each of our key service providers.

companyName: Rithm Capital Corp.

ticker: RITM


text: MGIC's Information Security Program includes information security policies, annual risk assessments and analyses, threat monitoring and alerting, vulnerability management, incident response, and data loss prevention controls. With this program, MGIC seeks to prevent, detect, and respond to unauthorized access, use, or disclosure of confidential information.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: The risks and threats that the Company faces in relation to cybersecurity include external threats such as hacking, malware and phishing attacks, which can compromise the security of our systems and data. Additionally, internal risks, such as employee negligence or malicious activities, can also pose significant cybersecurity threats. We continuously monitor and assess these risks to ensure the effectiveness of our cybersecurity measures. We regularly monitor our IT services to safeguard data and to help improve and stabilize our network and systems. We periodically audit our existing network and systems and make upgrades as needed. In addition to protective systems and measures, we believe that ongoing employee awareness and training play a critical role in data security. Training includes Security Awareness Proficiency Assessment ("SAPA") in pertinent knowledge areas such as internet use, email security, social media and mobile devices. Our SAPA scores are higher than the construction industry average, which we believe demonstrates our commitment to cybersecurity awareness.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Ameren also deploys a third-party cybersecurity risk management program, which extends the governance elements described above to our third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.

companyName: AMEREN CORP

ticker: AEE


text: We face cybersecurity threats in the ordinary course of our business and have faced cybersecurity threats and breach attempts in the past. Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on the cybersecurity risks we face, please refer to "We rely on information, communications and data systems in our operations. Systems and information technology interruptions and/or data security breaches could adversely affect our ability to operate, our operating results, our data security or our reputation." in Item 1A. "Risk Factors."

companyName: MASTEC INC

ticker: MTZ


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee (the "Committee") since its formation in 2017 oversight of business continuity, cybersecurity, privacy and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: CALIX, INC

ticker: CALX


text: Additionally, we use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such third-party service providers include professional service firms including outside legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services providers, and forensic investigators. These third-party service providers perform a variety of functions for our company, and we maintain a robust vendor management program to manage cybersecurity risks associated with our use of these providers. For example, we conduct risk and security assessment for potential vendors and their programs and periodically review such assessments; and we require our vendors to complete security questionnaires and conduct audits and vulnerability scans related to them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Moatable, Inc.

ticker: MTBLY


text: g. Our cybersecurity team regularly conducts tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Third-Party Engagement in Cybersecurity Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity risk management systems. These partnerships enable us to leverage specialized knowledge and insights, seeking to ensure that our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes threat assessments, consultations on security enhancements and cybersecurity strategies and trends and penetration testing designed to simulate an external cyberattack on the Company. We also periodically retain a third-party advisor to perform a cybersecurity materiality assessment of the Company using the NIST CSF framework. Finally, we also engage a third party to evaluate the cybersecurity strengths of our vendors as part of our third-party risk oversight, as described below under "Oversight of Third-Party Risks."

companyName: Integer Holdings Corp

ticker: ITGR


text: Risks from Cybersecurity Threats We have not been subject to cybersecurity challenges that have materially impaired or are reasonably likely to materially impair our operations or financial standing.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: To ensure our cybersecurity programs adhere to industry best practices, we have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework as a guide for our cybersecurity program. The NIST Cybersecurity Framework models the best practices for security and the capabilities needed to identify, protect, detect and respond to cybersecurity risks and events. In addition to the framework, we have a Security Action Committee comprised of the senior leaders of information technology, finance, and compliance that meets regularly to guide the evolution of our cybersecurity program, review potential incidents, and respond to trends in the cybersecurity landscape. We evaluate our physical, electronic and administrative safeguards on a continuous basis to ensure they are effectively deployed across the business. We also engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: We monitor our information systems for cybersecurity incidents, assess and identify any perceived risks and/or vulnerabilities, and escalate incidents according to Company procedures. Incidents classified to a level that may significantly impact the Company are escalated to senior management for monitoring and action if necessary.

companyName: ENDI Corp.

ticker: ENDI


text: The ultimate responsibility, among management, for effective risk management, including cybersecurity risk, resides with the Chief Executive Officer ("CEO"). The Bank's CEO and SISO annually certify compliance to the NYSDFS as required under DFS regulations.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: Cybersecurity Incident Impact While we identified no cybersecurity incidents, we have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. For additional discussions of risks from cybersecurity threats we face, see Item 1A "Risk Factors". There were no material cybersecurity incidents in 2024.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: EOG's cybersecurity team is led by EOG's group director, information systems and senior manager, information systems security, who each have over six years of experience overseeing EOG's cybersecurity processes and strategy.

companyName: EOG RESOURCES INC

ticker: EOG


text: Our Board of Directors plays a role in guiding and overseeing our cybersecurity strategies and has tasked our Audit Committee with the responsibility for cybersecurity oversight by setting policies, reviewing risk management strategies and reviewing compliance with legal and regulatory requirements. The Audit Committee, as appropriate, briefs the Board of Directors on cybersecurity matters.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Before purchasing third-party technology or other solutions that involve exposure to the Company's assets and electronic information, our Information Technology group requires those companies to complete a security review before being approved to work with the Company. We utilize an external tool to manage critical vendors. Vendors are assessed to determine inherent and residual risk. Annually, the security team conducts a risk assessment that is informed by industry standards.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: Management and Strategy have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function, which we rely on a third-party vendor who is associated with a Related Party. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Envoy Medical, Inc.

ticker: COCH


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: The Company's CIO, senior vice president responsible for technical services, and vice president responsible for IT risk management manage all material risks associated with cybersecurity threats. Combined, these identified leaders have more than 50 years of IT and cybersecurity related experience across multiple industries. In the event of a cybersecurity incident, these leaders engage the Incident Response Team (IRT), a team comprised of senior- and executive-level leaders from various business units, legal and finance departments, and the corporate communications team, to help manage and maintain business operations throughout the incident and any recovery period. The IRT is responsible for reporting details of the incident and its impact on the business to the Executive Leadership Team (ELT) and making key recommendations for managing operations. The ELT is responsible for advising the Board of any material cybersecurity incidents. Both the ELT and the IRT have participated in formal cybersecurity response training.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Our Director of Information Security leads the Information Security Program and reports to the CIO, who also provides additional oversight of the Program. The Director of Information Security has over 19 years of experience in the information technology and information security fields and the CIO has over 29 years of experience in the information technology and information security fields. In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives. The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr. Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO. Information security risks are reviewed with the Security Steering Committee periodically or as needed.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: We conduct periodic risk assessments of our information technology systems as part of our cybersecurity risk management processes and to evaluate the effectiveness of applicable security controls. Our efforts to address cybersecurity risks also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.

companyName: MYOMO, INC.

ticker: MYO


text: All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Security breaches and other disruptions to the Company ' s information technology infrastructure could interfere with the Company ' s operations, compromise information belonging to the Company and our customers and suppliers and expose the Company to liability, which could adversely impact the Company ' s business and reputation " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K which disclosures are incorporated by reference herein.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Our Audit Committee is responsible for board-level oversight of cybersecurity risk and reports back to our Board about this and other areas within its responsibility. As part of its oversight role, our Audit Committee receives reporting about our practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from our Chief Financial Officer, and through our MSSP. Our Chief Financial Officer is principally responsible for overseeing our cybersecurity risk management program and incident reporting. In the event there is a material cybersecurity breach or incident, our Chief Financial Officer works in coordination with our MSSP to assess and respond, including by reporting the breach or incident to our Board and/or applicable regulatory authorities, as necessary or required. Our Chief Financial Officer has a high level of exposure to cybersecurity oversight through his current work overseeing our cybersecurity risk management and MSSP and has over 10 years of experience with managing risks in environments similar to ours, including risks arising from cybersecurity threats.

companyName: NorthStar Healthcare Income, Inc.


text: To operate our business, we utilize certain third-party service providers and vendors to support a variety of functions. We seek to engage reliable, reputable service providers and vendors that maintain cybersecurity programs, and we implement a vetting process to ensure that all third-party service providers and vendors comply with our cybersecurity program requirements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: Solana Co

ticker: HSDT


text: The success of our business operations depends on the security, confidentiality, integrity and availability, of confidential and sensitive information. Such information includes personal information that we collect and process on our own and using systems and platforms provided by our vendors and other third parties on which we rely. Consequently, we maintain a data protection program, which includes physical, technical, and administrative safeguards, designed to identify, prevent, and mitigate the risks posed by cybersecurity threats, and to identify, analyze, address, mitigate and remediate any cybersecurity incidents that may happen in an efficient and timely manner. As part of our program:

companyName: Rumble Inc.

ticker: RUM


text: The plan is regularly updated, reviewed by management, and tested yearly involving relevant stakeholders so that all are familiar with their roles and responsibilities in case of a cyber incident.

companyName: International Seaways, Inc.

ticker: INSW


text: Our Group Head, Cybersecurity/Information Security Officer has a total of more than 28 years of experience in cybersecurity, technology and information technology roles with financial services, technology and consulting companies. She joined Envestnet in 2020.

companyName: ENVESTNET, INC.


text: Under the oversight of the Audit Committee of the Board of Directors, the Company's Chief Financial Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. Although our Chief Financial Officer has extensive and broad expertise in overall accounting and executive management, he does not have any prior work experience, relevant degrees, certifications or other background specific to cybersecurity.

companyName: Next Bridge Hydrocarbons, Inc.


text: The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic. The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity, and risk management experience in the manufacturing, electric, defense, financial, and retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure, and military defense systems.

companyName: MOSAIC CO

ticker: MOS


text: We have taken steps to develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Our Board, with the assistance of our Audit Committee, oversees the Company's cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from our Chief Technology Officer (CTO) on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from the CTO. Further, the Board oversees cybersecurity as part of our enterprise risk management program.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee of the Board also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Industry and Economic Risks • our dependence on the U.S. government for a substantial portion of our business • significant delays or reductions in appropriations and/or for our programs, and U.S. government funding and program support more broadly, including as a result of a prolonged continuing resolution and/or government shutdown, and/or related to the global security environment or other global events • significant delays or reductions in payments as a result of or related to a breach of the debt ceiling • the use of estimates when accounting for our contracts and the effect of contract cost growth and our efforts to recover or offset such costs and/or changes in estimated contract costs and revenues, including as a result of inflationary pressures, labor shortages, supply chain challenges and/or other macroeconomic factors, and risks related to management's judgments and assumptions in estimating and/or projecting contract revenue and performance which may be inaccurate • continued pressures from macroeconomic trends, including on costs, schedules, performance and ability to meet expectations • increased competition within our markets and bid protests

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: As of April 1, 2024, the Trust's business strategy, operations, or financial condition have not been materially affected by, and are not likely to be materially affected by, any cybersecurity threats or incidents.

companyName: Frontier Funds