text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibility and has delegated responsibility for oversight of this risk to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. The Audit Committee oversees our enterprise risk assessment process, and cybersecurity represents an important component of our overall approach to risk assessment. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Champion Homes, Inc.

ticker: SKY


text: CFO is responsible for escalation of pertinent cybersecurity risks to the board of directors. This includes briefings on existing threat scenarios, updates on incident response efforts, and recommendations for enhancing our cybersecurity stance.

companyName: Vertical Data Inc.

ticker: VDTA

secItem: Item 1C


text: We employ information technology and cybersecurity technologies that are designed to protect Sabre's technology environment, detect threats, respond to threats and help support operational resilience. These technologies facilitate the identification of threats and vulnerabilities that may exist in the Sabre technology environment. Protective measures are employed to counter threats and mitigate risk, supporting operational resilience of our technology products. These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools. Accompanying these tools are various processes such as annual security education and monthly awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment. We practice data protection techniques and processes that are designed to treat our customer data with care. We also utilize third-parties, consultants, and auditors to regularly assess our security program. These assessments include periodic security maturity assessments in which third-parties assess security program maturity against established standards and industry benchmarks, including NIST Cybersecurity Framework 2.0. We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.

companyName: Sabre Corp

ticker: SABR


text: Our Board of Directors considers cybersecurity as part of its overall risk oversight function and believes it has established robust oversight mechanisms to support effective governance in managing risks associated with cybersecurity threats. All of our Board members have experience in the technology industry and our CTO, Yoav Landman, is a member of our Board. Data protection under their guidance and oversight remains a strategic priority at the highest levels of our organization. The Board has delegated to the Audit Committee the responsibility to oversee the information security program (see below) and is also updated regularly regarding matters discussed with the Audit Committee.

companyName: JFrog Ltd

ticker: FROG


text: Like many companies, we face significant and persistent cybersecurity risks. The small size of our organization and limited resources could exacerbate these risks. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced the ordinary course of our business, we collect and store sensitive data, including intellectual property. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management strategy, which is comprised of a wide array of policies, standards, architecture, processes, and governance. Under the guidance and supervision of our Chief Executive Officer, we further limit risk by delegating our information technology and cybersecurity to a leading third-party IT consultant to safeguard our networks. Additionally, as an added layer of security, all of our data is stored on the cloud.

companyName: Sonnet BioTherapeutics Holdings, Inc.


text: • Incident response. The Cybersecurity Incident Response Team ("CIRT"), deploys, maintains, and monitors various tools and processes designed to safeguard against and detect cybersecurity incidents that may occur. As part of our incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. In accordance with established written policies and procedures, escalation protocols are used to provide information to, and engage with, executive management, the Cybersecurity Committee and the Board, throughout the incident response process. The CIRT reviews these controls regularly, and makes enhancements as needed to incorporate lessons learned, updated industry standards, and any new or revised legal requirements.

companyName: JABIL INC

ticker: JBL


text: Our Information Security Officer is accountable for managing the information security department and executing the information security program. The information security department is responsible for cybersecurity risk assessments, alert monitoring, incident response, vulnerability assessment, threat intelligence, identity access governance, and third-party information security risk management. The department consists of information security professionals with varying levels of education, experience and certifications. Our information security department is further supported by our first line of defense, the Information Technology department and a third-party managed service security provider. The information technology department is responsible for the patch and vulnerability management, identity and access management, endpoint and network security, IT asset management program, and backups and recovery operations.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives periodic briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from a combination of our CDIO, CISO, Deputy General Counsel, internal security staff, external counsel or external experts, as part of the Board of Director's continuing education on topics that impact public companies.

companyName: AMERICAN AIRLINES, INC.


text: Cybersecurity is an ongoing priority, and we have developed and implemented a cybersecurity risk management program designed to identify, assess, prioritize, and mitigate cybersecurity risks to ensure our compliance with applicable privacy and cybersecurity laws.

companyName: Compass, Inc.

ticker: COMP


text: Like most technology companies, we have suffered cybersecurity incidents in the past, and expect that we may face cybersecurity incidents in the future. As of the date of this report on Form 10-K, however, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For additional information about the cybersecurity risks that we face, please see the discussion in Item 1A. "Risk Factors" in this annual report on Form 10-K, including the risk factor entitled "Business, Financial and Operational Risks; Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability."

companyName: Oportun Financial Corp

ticker: OPRT


text: Internal security controls are designed to align with standards set by the National Institute of Standard and Technology. We monitor emerging data protection laws, conduct background checks of our employees in specific technology and cybersecurity roles, apply least privilege access to users, test the maturity and readiness of our cybersecurity program, conduct table top exercises based on current threat scenarios to increase awareness, conduct phishing testing, provide cybersecurity training to our Board and employees, and provide cybersecurity alerts to our customers on ongoing threats. We monitor notifications and alerts from the Financial Services Information and Analysis Center and other industry cybersecurity sites to stay abreast of the most recent cybersecurity alerts.

companyName: ENTERPRISE BANCORP INC /MA/


text: Engage Third Parties on Risk Management To address the evolving nature and complexity of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These partnerships enable the Company to leverage specialized knowledge and insights with respect to its cybersecurity strategies and processes. The collaboration with these third parties includes regular audits, threat assessments, penetration testing, and consultation on security enhancements.

companyName: YORK WATER CO

ticker: YORW


text: We also engage vendors from time to time to assist with enterprise managed detection and response, security information and event management, and enterprise vulnerability management. These vendors also assist us from time to time in identifying, assessing and managing material risks from cybersecurity threats. The vendors include threat intelligence service providers, cybersecurity software providers and managed cybersecurity service providers.

companyName: aTYR PHARMA INC

ticker: ATYR


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks the Trust faces from cybersecurity threats, please see Item 1A. Risk Factors.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Chief Technology Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from our third-party IT service provider.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: We rely upon information technology networks and systems to process, transmit, and store electronic information, and to manage or support virtually all of our business processes and activities. Accordingly, we maintain a comprehensive Information Security Program, anchored in a multi-tiered, defense-in-depth strategy designed to identify and mitigate risks from cybersecurity threats. We believe that our Information Security Program aligns with industry frameworks and assesses security trends, and facilitates identification and reduction of vulnerabilities. Our cybersecurity strategy considers existing risks to our company and those that we are likely to encounter based on our industry, company profile, and business objectives. Consideration of risks from cybersecurity threats is a key component of our overall enterprise risk management strategy.

companyName: Performance Food Group Co

ticker: PFGC


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls ("SOC 2") testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider ("MSSP"), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.

companyName: First American Financial Corp

ticker: FAF


text: Westwood management is responsible for the execution of the framework for the management of our information security. These responsibilities include, but are not limited to: a. Designing, implementing and executing our framework over information security management; b. Reviewing and updating our policies and procedures annually;

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.

companyName: Village Bank & Trust Financial Corp.


text: Our management team's experience includes a diverse background in telecom, financial services and other industries, with decades of experience in various aspects of technology and cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Braves Holdings' SVP and Head of Technology has more than 20 years of leadership experience, including delivering technology solutions and designing and building new business strategies and Braves Holdings' Director Cybersecurity and IT Infrastructure has more than 20 years of cybersecurity and information technology experience and is a Certified Information System Security Professional. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: We have established a documented cybersecurity incident materiality assessment and disclosure program that is jointly managed by our Incident Response, Cybersecurity, and Corporate Legal teams. This program calls for the immediate assessment of potentially material cybersecurity incidents, and the appropriate escalation to our cross-functional Disclosure Committee in order to facilitate the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner and elevated to our Audit Committee or Board if needed.

companyName: Dayforce, Inc.

ticker: DAY


text: For additional information about these risks, see " Risks Related to Our Business—We rely significantly on technology and systems to support our production, supply chain, payments, financial reporting and other key aspects of our business. Any failure, inadequacy, interruption or security failure of those systems could have a material adverse effect on our business, reputation and brand, financial condition, and results of operations " and " Risks Related to Our Business—System security risk issues, and disruption of our internal operations or information technology systems, could have a material adverse effect on our business, financial condition, and results of operations " in Item 1A-Risk Factors.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Our annual testing, which is conducted by an industry-leading third-party cybersecurity firm, encompasses external and internal penetration tests, Wi-Fi tests, social engineering and physical access testing for all subsidiaries. We also use a vulnerability management platform to provide comprehensive visibility and tracking of assets to aid us in systematically identifying, measuring and prioritizing cybersecurity and technology risks. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: The Company (or a third party on which it relies) may not be able to fully, continuously and effectively implement security controls as designed or intended. The Company utilizes a risk-based approach and judgment to determine which security controls to implement, and it is possible that the Company may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties on which it relies).

companyName: Container Store Group, Inc.


text: We conduct annual risk assessments and perform as needed updates to our risks to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We engage consultants, third parties and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and communications.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: The Board of Directors, both directly and through the Audit Committee, oversees management's responsibility of ensuring proper functioning of our cybersecurity risk management program. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate cybersecurity risks. Recently the Audit Committee added a member with significant cybersecurity experience. The Audit Committee receives a cybersecurity update at each regular meeting of the Board covering cybersecurity risks, cybersecurity staffing and staff development including certifications and training. These updates are given either in person by the CIO and CISO or in written presentations created by them.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Security Awareness. Annual training is conducted for continuing education for all employees. Routine phishing tests are administered routinely. We also post articles on our intranet of common attack schemes for our employee's awareness.

companyName: FNB CORP/PA/

ticker: FNB


text: Our overall cybersecurity program includes, amongst other things: • security tools, technologies and processes, control reviews, policy reviews, penetration tests and investments in our security infrastructure; • cybersecurity awareness training exercises for our employees, including phishing simulations to raise awareness of spoofed or manipulated electronic communications and other critical security threats; • annual review of System and Organization ("SOC") reports for our core third-party providers based on our assessment of their respective criticality and risk profile; and • a Cybersecurity Incident Response Plan that provides a framework and guidelines for responding to cybersecurity incidents that may compromise the confidentiality, integrity and availability of our critical systems and information.

companyName: KILROY REALTY CORP

ticker: KRC


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. In partnership with our designed outsourced technology provider, we have implemented extensive processes and controls to assess, manage and protect against material risks from cybersecurity threats, including the following: • a managed detection and response platform that is monitored at all times by members of our third-party technology provider's Security Operations Center team; • periodic penetration testing and vulnerability scans; • quarterly cybersecurity training and phishing email exercises for all employees and officers; • vendor cybersecurity diligence; • cybersecurity insurance; and • a cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: Federated Hermes maintains a written cybersecurity program protocol, along with ancillary policies and procedures, which set forth the key features of the cybersecurity program. These policies and procedures strive to reflect what Federated Hermes believes are best practices for assessing, identifying and managing cybersecurity risks and are reviewed and updated on a regular basis.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Material Cybersecurity Risk Assessment We have recently completed an IT Audit of our China Office as part of our broader cybersecurity risk management efforts. This audit identified certain gaps in our systems, processes, and controls specific to our operations in China. These gaps do not indicate the presence of any known cybersecurity threats or incidents, but they highlight areas for improvement to strengthen our overall cybersecurity posture.

companyName: AIRGAIN INC

ticker: AIRG


text: Our cybersecurity risk management risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; a security team principally responsible for managing (1)

companyName: Cuentas Inc.

ticker: CUEN


text: Our former CIO left the Company in January 2025. Currently Shashank Patel, our Chief Financial Officer, is serving as Interim CIO as we proceed with an executive search to appoint a permanent CIO. Mr. Patel has been overseeing the Company's Information Technology function since he joined the Company in July 2018. References to the CIO and the CIO's duties refer to our CIO's historical role, Mr. Patel's interim CIO role, and our future CIO's role.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CTO and CISO have primary responsibility for managing our information security program and efforts, including with respect to cybersecurity. They work closely with key stakeholders, including internal committees such as our Cyber Steering Group, peer institutions, and industry groups, in order to manage cybersecurity and information security risk. Our internal audit team is responsible for testing and auditing our information-technology internal controls. In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: Cohen & Co Inc.

ticker: COHN


text: The Assistant Vice President, Information Technology Security reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a regular basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes. The Audit Committee actively participates in cybersecurity-related business decisions.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: The audit committee and our risk committee, a management committee overseeing our enterprise risk management program, receive reports from our CISO regarding key cybersecurity risks facing the company, our cyber risk management program, significant cybersecurity incidents involving us or our third-party service providers, and the progress of ongoing initiatives as well as the effectiveness of internal control and compliance mechanisms. The audit committee, in turn, briefs our board of directors on its cybersecurity oversight activities as appropriate or necessary.

companyName: Maplebear Inc.

ticker: CART


text: The Board oversees risks from cybersecurity threats through the same framework it uses to oversee the management of our risk exposure in general. Cybersecurity risks, including operations disruptions, outdated enterprise software and damage reputation, have been specifically incorporated into our enterprise risk management processes. These risks are scored based on impact, likelihood and established controls. Action plans are then established for each of the risks and are incorporated into objectives. Risks are then tracked and integrated into reporting and disclosure processes. Risks are reviewed at least bi-annually by a committee made up of representatives from finance, internal audit, treasury, operations, legal and others. Management at least annually provides to the Board updated information concerning cybersecurity threats as well as management's efforts to mitigate such threats. The Board then is responsible for overseeing that management responds appropriately. The Audit Committee, which is made up solely of independent directors, is responsible for overseeing Company policies and practices with respect to cybersecurity issues.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: As required by federal banking laws and regulations, the Bank's cyber/information security risk management practices include risk assessments, controls and practices specifically for cybersecurity, information technology deployment and third -party information technology vendor risk management.

companyName: BankFinancial CORP


text: Amgen has a multi-layered and iterative approach towards assessing, identifying, managing and mitigating risks from cybersecurity threats. The Amgen Technology & Medical Organizations (ATMOS) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations. The ATMOS function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices. The CDT team also monitors for cybersecurity threat activity and seeks to mitigate the impact from cybersecurity incidents by deploying information security engineers, system architects, analysts and cybersecurity specialists to provide monitoring, reporting and management of cybersecurity incidents.

companyName: AMGEN INC

ticker: AMGN


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: NewHydrogen, Inc.

ticker: NEWH


text: Substantially all our locations are branded fuel locations for which sensitive data related to debit and credit card transactions for fuel or merchandise products or services does not pass through our networks; rather, such information passes through the branded fuel supplier's (or its service providers') networks. However, in the ordinary course of our business, we collect and store sensitive data of certain of our dealer and tenant customers, suppliers and other business partners.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CISO, Mr. Marshall Erwin. Our CISO has experience in the technology and government industries, including through his previous roles as CISO for a major Internet company and an analyst in the US intelligence community. He also served as the cybersecurity and counterterrorism advisor on the Senate Homeland Security and Government Affairs Committee and as the intelligence specialist at the Congressional Research Service.

companyName: Fastly, Inc.

ticker: FSLY


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and ISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The ISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and ISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The ISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets at least four times a year. The IT and Audit Committees assist the Board of Directors in its oversight.

companyName: RBB Bancorp

ticker: RBB


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, including those related to the Company.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: We perform regular vulnerability scanning of our systems in order to ensure appropriate security controls are in place and function in accordance with established policies. We also have ongoing engagements with security consultants and other third parties as required to assist with assessing, identifying, and managing cybersecurity risks. These vendors help us with annual penetration testing and other items as needed. We have a robust internal controls framework and process and issue annual SOC 1 Type 2 reports covering our DV+, Streaming, and SpringServe platforms. In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps ensure compliance with our control framework.

companyName: MAGNITE, INC.

ticker: MGNI


text: To meet these objectives and oversee the programs, we employ a Chief Information Security Officer ("CISO"). The CISO has over 27 years of cybersecurity experience, 25 years of cybersecurity leadership experience, an MBA in Information Systems, a Master of Science degree in operational analysis, a bachelor's degree in operations research and holds a Cyber Risk Oversight Certificate from the National Association of Corporate Directors and is a Certified Information Systems Security Professional ("CISSP"). The CISO works closely with the head of information technology and the data privacy officer to collectively manage our global cybersecurity, information technology and data privacy programs.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, we have experienced threats to our data and systems in the past, including malware and viruses. For a description of the risks we face from cybersecurity threats that may affect us and how, see our risk factors under Part 1. Item 1A in this Annual Report on Form 10-K, including under the heading "Disruptions to our information technology systems, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and other confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition."

companyName: COPART INC

ticker: CPRT


text: Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee further oversees cybersecurity and other risks through a subcommittee, the Enterprise Risk Oversight Committee ("EROC"), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee ("TSRC") and the Operational Risk Committee ("ORC" and, together with the EROC and TSRC, the "Management Committees"). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management's current business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Our Director of Enterprise IT Risk is responsible for the Company's information technology governance, risk, and compliance program. In this role, the Director of Enterprise IT Risk provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high level risks receive appropriate attention. The Director of Enterprise IT Risk is a member of the Company's Corporate Risk Management Group and reports to our Chief Risk Officer, who in turn reports to our CEO. Our Director of Enterprise IT Risk has over two decades of business continuity, crisis management and risk experience in the financial services industry and maintains related industry certifications.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: The Vice President of Technical Services serves as the Senior Management sponsor for cybersecurity risk and mitigation plans. Day-to-day management of cybersecurity risks falls under the responsibility of the Director of Information Security and Information Technology ("ISIT") and the Cybersecurity Manager. Our Cybersecurity Manager is a retired U.S. Military Cyber Warfare Officer with over 15 years of experience in Cybersecurity Operations and a member of the International Association of Drilling Contractors Cybersecurity Committee.

companyName: Seadrill Ltd

ticker: SDRL


text: Cyber Defense. Our dedicated cyber defense team provides services to identify, help prevent, detect and respond against cybersecurity threats and intrusions and collaborates with internal and external stakeholders to help protect PMI's information, mitigate operational disruptions and maintain business continuity. The cyber defense team's controls and procedures identify and enable escalation of cybersecurity incidents to the applicable governing body within PMI, as appropriate, to meet disclosure and reporting requirements for such incidents.

companyName: Philip Morris International Inc.

ticker: PM


text: All critical systems have rigorous data backups and are designed for disaster recovery, ensuring business continuity in the event of a catastrophic incident. As part of continuous improvement, disaster recovery testing is being conducted and documented.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary processes and controls are in place to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the ERM committee and the cybersecurity team, management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: We maintain a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management processes include security controls, monitoring systems, employee training, and cybersecurity risk insurance. Our processes include overseeing and identifying risks from cybersecurity threats associated with the use of tools and services from third-party providers.

companyName: Whole Earth Brands, Inc.


text: We continue to evaluate our cybersecurity control processes and procedures to address the evolving cybersecurity risks that we may face in an increasingly technically capable environment. We are implementing policies to educate and provide guidance to our personnel, including awareness programs and other related cybersecurity best practices. We plan to conduct technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We also plan to conduct programmatic risk assessments, including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we will evaluate: i) whether and how to implement, and maintain reasonable safeguards to minimize identified risks, ii) how to reasonably address any identified gaps in existing safeguards; and how to regularly monitor the effectiveness of our safeguards. As we are a small pre-revenue company, we currently outsource our information technology (IT) functions to a third party. Working with the outsourced IT firm, our president will manage the risk assessment and mitigation process. Third parties will play an important role in our cybersecurity program. We intend to engage third-party service providers to conduct evaluations of our security controls, including penetration testing and consulting on best practices.

companyName: Modular Medical, Inc.

ticker: MODD


text: Depending on the nature of the environment, system and/or data, we implement and maintain various technical and organizational measures, processes, standards and/or policies designed to manage and mitigate cybersecurity risks, including, for example, as may be appropriate: employee training, software design review, static code analysis, coordinated vulnerability disclosure and bug bounty program, penetration testing performed by an outside assessment firm, vulnerability scanning and management, endpoint and network security monitoring, access controls, vendor risk management, asset management, and software updates and patching.

companyName: Asana, Inc.

ticker: ASAN


text: As a leading provider of technology-enabled healthcare and public health services, medical logistics, and readiness enhancement services, we continuously monitor for and defend against cyber threats and advanced persistent threats both internally and for our clients. Our cybersecurity risk management program is an integral part of our overall enterprise risk management program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents As a public company and a government contractor, we are required to comply with extensive security and compliance regulations and standards and we employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity risk management program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and comply with extensive regulations, including U.S. government cybersecurity regulations. Our policies and implemented controls are assessed at least annually by external organizations for compliance with Federal Risk and Authorization Management ("FedRAMP"), Federal Information Security Modernization Act ("FISMA"), Cybersecurity Maturity Model Certification ("CMMC"), and International Organization for Standardization ("ISO") 27001 standards. We also conduct periodic penetration tests, threat simulations, and exercises to test the effectiveness of our cybersecurity defenses and controls, as well as our ability to respond to and recover from cybersecurity incidents. We undertake efforts to address and mitigate risks from vulnerabilities identified during such assessments, simulations, and exercises, including through employee cybersecurity training and ongoing investments in capabilities to protect our assets.

companyName: DLH Holdings Corp.

ticker: DLHC


text: The information security team also has processes in place to inform and update management and, as needed, the audit committee about cybersecurity incidents that may pose significant risk to the company. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' data and systems. For more information, please see " Item 1A, Risk Factors. "

companyName: Blueprint Medicines Corp


text: The audit committee of our board of directors is responsible for oversight the Company's cybersecurity risk, including oversight and mitigation of risks from cybersecurity threats.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: The Company's strategic approach to cybersecurity governance, characterized by our rigorous third-party assessments, industry certifications, and a clear organizational reporting structure, underscores our unwavering dedication to safeguarding sensitive information and maintaining trust.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Our CIO has served in various roles in information technology for over 35 years. Our Hotels Chief Information Technology Officer holds an undergraduate degree in business administration and a master's degree in management of information systems and has served in various roles in information technology for over 30 years. Our Vice President of Information Security has served in various roles in information technology and information security for over 15 years, and has attained the professional certifications of PCI-ISA and PCI-DSS. Our General Counsel and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have significant experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats.

companyName: MARCUS CORP

ticker: MCS


text: In fiscal 2025, we engaged an independent cybersecurity advisory firm to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we engaged an international cybersecurity company, specializing in IT services and software development, to augment our monitoring, incident response, detection, and forensics efforts; various Information Sharing and Analysis Centers (ISACs) for threat intelligence, and a recognized cyber defense company that specializes in threat intelligence and incident response services.

companyName: Aramark

ticker: ARMK


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assessed our cybersecurity risk based on the Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's operations, risk management, internal audit and other key business functions, as well as the members of the board of managers in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: The Company's Chief Information Security Officer (CISO) is responsible for managing the Company's cybersecurity program and reporting on cybersecurity matters to management, the Cyber Governance Committee, and the Company's board of directors. The CISO has over twenty years of cybersecurity and technology experience, originating with cryptography and security experience as a military officer and progressing through senior management roles at prominent global audit and technology consulting corporations. The CISO leads the Company's cybersecurity and information technology compliance department which is staffed with technical and compliance personnel with the appropriate experience and certifications required to accomplish the department's mandates. The CISO is supervised by the Company's Chief Technology Officer.

companyName: Vestis Corp

ticker: VSTS


text: In an effort to deter and detect cyber threats, we annually provide all of our personnel, including full-time and part-time employees and temporary staff, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We have implemented a proactive cybersecurity monitoring program that is designed to achieve threat detection and swift response, which includes the use of best-in-class tools to mitigate vulnerabilities and protect our information assets and operations. We also utilize a stringent endpoint security practice, geo-fencing and geo-blocking on firewalls, and automatic prioritization of emails to enable our information technology department to efficiently prioritize response to the most dangerous threats.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Risks from Threats and Incidents Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2024, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this report for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: External partners are a key part of the Company's cybersecurity infrastructure. XPEL partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise to control and monitor our processes.

companyName: XPEL, Inc.

ticker: XPEL


text: Our Vice President, Information Technology, who reports directly to our Senior Vice President, Operations, has over 25 years of experience managing information technology and cybersecurity matters and is certified as Certified Information Systems Security Professional. Together with our Senior Vice President, Operations and the other members of our senior leadership team, our Vice President, Information Technology is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. STAAR's Chief Information Officer leads a team of information security professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our retained external cybersecurity consultants. This team collaborates with STAAR's legal and internal audit functions to address cybersecurity and data privacy risks. The Company's internal information security and data privacy specialists have certifications from various organizations, including ISC2 (Certified Information Security Systems Professional or CISSP), Global Information Assurance (GIAC), the Computing Technology Industry Association (CompTIA) and International Association of Privacy Professionals (IAPP).

companyName: STAAR SURGICAL CO

ticker: STAA


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Audit Committee) oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: HilleVax, Inc.


text: Our CFO is responsible for cybersecurity risk management and has experience overseeing IT departments in previous roles. Our principal accounting officer, or PAO, oversees the IT department and in that capacity is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our PAO has significant experience with managing access to key company-wide information systems. Our head of IT is responsible for assessing and managing our material risks from cybersecurity threats and for our cybersecurity protections generally, including helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our head of IT has prior work experience in cybersecurity, holds relevant degrees and current cybersecurity certifications. The Audit Committee receives periodic reports from our CFO and head of IT concerning cybersecurity threats and risks, and the processes that we have implemented to address and mitigate them. The Audit Committee updates the Board on such cybersecurity issues as part of its general committee report to the Board at regular Board meetings. Our Board is responsible for approving budgets to support those activities.

companyName: NGM BIOPHARMACEUTICALS INC


text: We engage with third party assessors, consultants, and auditors to test our cybersecurity maturity and to drive continuous monitoring and improvements. The engagement includes having independent third parties perform compliance, technical, and maturity assessments, such as (1) attack surface assessment, (2) penetration testing assessment, and (3) cybersecurity maturity assessments. We also annually engage third parties and our internal audit department to assess our information security programs, whose findings are reported to the Audit Committee of the Board.

companyName: Crocs, Inc.

ticker: CROX


text: Third parties play a key role in support of our Cybersecurity Program. The Chief Information Security Officer coordinates third-party assessments with the Company's Internal Audit team. Third parties are regularly engaged to assess our security controls and incident response capabilities. We invest in tools to assess our external vulnerabilities and perform penetration testing regularly.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Engage Third-parties on Risk Management We engage third party auditors in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as with monitoring and testing our safeguards at different levels. We require each third-party service provider to ensure that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Material Cybersecurity Threat Risks. The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2023. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Information Risk" contained in Item 1A. Risk Factors.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Risk Management Strategy While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our cybersecurity strategy that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees, or other key stakeholders.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation. Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Office of Privacy and Responsible Technology, Human Resources, Procurement, Finance and Operations, and Corporate Security. The incident response teams advise and consult with the CLO and the SVP Sponsor, as appropriate.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: The Company maintains a formalized incident response (IR) plan to address and remediate cybersecurity incidents. The plan defines roles and responsibilities and includes runbooks for likely scenarios. The Company performs testing of the IR plan at least annually with the results reported to senior management.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: As part of our risk management process and compliance with our ISO 27001 cybersecurity certification requirements, we conduct penetration testing, security audits, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems, to undertake data protection and cybersecurity training and compliance programs as part of the employee onboarding process, as well as annually thereafter. In addition to our in-house cybersecurity capabilities, we engage consultants and other third parties as necessary to assist with assessing, identifying, and managing cybersecurity risks. We have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides governance and guidance in responding to cybersecurity incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the CIRP aligns with the ISO 27001 standard. The CIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: FLOWSERVE CORP

ticker: FLS


text: Our Information Security team conducts annual information security awareness training for all employees. In addition, we have retained a third-party vendor to provide regular online awareness training modules for our employees on important topics such as spoof login, impersonation attack, identity theft, stolen laptop, and passwords. Each module contains a video vignette followed by a quick quiz.

companyName: Century Communities, Inc.

ticker: CCS


text: All personnel are expected to maintain a computer free from games and potentially hazardous sites such as non-solicited offers of services, purchases or investments, get rich-quick-schemes, sites with pornographic content. Personnel are required to maintain good internet security software and regularly to check their computers for cyber breaches or viruses.

companyName: NEXT-ChemX Corporation.

ticker: CHMX


text: The Audit Committee is responsible for evaluating and overseeing the management of risks related to information technology, which includes cybersecurity and data security risks. The Audit Committee receives quarterly reports from our Chief Information Security Officer (CISO) regarding cybersecurity and data security matters and related risk exposures. The Audit Committee Chair regularly updates the Board on such matters and the Board also periodically receives reports from management directly. Our Board escalation protocols require material cybersecurity incidents or data breaches to be reported to the Board on a real-time basis.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: The Company maintains a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. These include risks relating to disruption of business operations or financial reporting systems, intellectual property theft, exposure to fraud or extortion, harm to employees or customers, violation of privacy laws or other regulatory and compliance lapses, reputational risk, and inability to consistently deliver digital business solutions. For more information on the Company's risks related to cybersecurity, refer to "Risk Factors" in Item 1A of this Annual Report on Form 10-K.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer, Information Technology Officer and Chief Risk Officer. Together with the Bank's Electronic Data Processing (EDP) Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security and Information Technology Officers of the Bank work to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: Diamondback's cybersecurity risk management program, which it provides to us under the services and secondment agreement, includes: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise IT and operational technology ("OT") environments; • a security team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) its response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of its security controls; • security tools deployed in the IT and OT environments for protection against and monitoring for suspicious activity; • cybersecurity awareness training of its employees, including incident response personnel and senior management, including those who provide these services for us; • cybersecurity tabletop exercises for members of its cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: VNOM Sub, Inc.


text: Internally, the cybersecurity program is managed by the Company's Senior Vice President and Chief Information Officer. She has held senior management positions in information technology, management information systems and information security for over 30 years. She reports regularly to the risk and audit committees of the Board of Directors about the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, the full board annually assesses all critical risks of the Company, including cybersecurity risks, and also receives periodic updates relating to key cybersecurity issues as part of their oversight.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: As of December 31, 2023, we were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: ZimVie Inc.


text: Our information security policies and processes are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security and confidentiality of consumer information. We use various tools and strategies to identify and assess material risks from cybersecurity threats. We conduct ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing. The cybersecurity risk assessments, vulnerability testing, and penetration testing are designed to identify internal and external risks to the security of our information systems.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: The Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing our risks from cybersecurity threats. The CISO has been with the Company for three years, bringing more than 30 years of technology experience, including 15 years in cybersecurity, and has held the CISO position at other companies before joining Exact Sciences. The CISO leads the cybersecurity team consisting of experts in strategy, governance, risk management, compliance, engineering and development, security operations, and incident management.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: Our CISO has over 25 years of information technology experience, including leading data analytics, customer relationship management, architecture and application development teams. He has been leading our global information security program for almost seven years. He is a Certified Information Systems Professional, a member of Google Cloud CISO Customer Advisory Board and New Jersey Infragard and completed the FBI CISO Academy. He joined the Company over 25 years ago and has extensive knowledge regarding our business processes and the associated information technology platforms utilized worldwide, enabling him to guide his organization to protect the Company's systems and information.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: We have implemented best practices and established numerous programs and controls to reduce cybersecurity risk. Our Information Security Program includes physical, administrative, and technical safeguards. Some key components of the Information Security Program include: Security awareness training for Team Members. A dedicated security operations team to monitor, analyze, and respond to security threats. Security governance to manage and maintain security processes. Intrusion, detection, and prevention systems. A vulnerability management program to identify and remediate security liabilities. A configuration management program to harden systems based on industry standards. Industry-leading email security, endpoint detection, and response platforms. Threat intelligence from multiple resources to identify and anticipate emerging threats. Network and web application firewalls. Multi-factor authentication. Network segmentation to isolate and safeguard critical systems and sensitive data.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management; assessment of material cybersecurity risks posed by third -party service providers, including risks to employee, customer and financial information; a cybersecurity incident response protocol that includes procedures for responding to cybersecurity incidents; and business continuity plans.

companyName: Azenta, Inc.

ticker: AZTA


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has more than a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.

companyName: Tradeweb Markets Inc.

ticker: TW


text: This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Bioxytran.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Our board of directors' oversight of cybersecurity risk management is supported by our Chief Financial Officer and Compliance Officer, who interacts directly with, and is provided relevant information by, our cybersecurity team. While our board of directors has the ultimate oversight responsibility over the management of cybersecurity risk, our audit committee reviews the risk management process relating to cybersecurity on a regular basis.

companyName: CEVA INC

ticker: CEVA


text: Premier's risk management program is designed to o identify, measure, prioritize, and manage risk, including information security and cybersecurity risk, in relation to the Company's desired risk appetite established by its Board of Directors. Premier uses a risk-based approach to manage and mitigate threats to information technology resources. Periodic risks assessments are conducted to identify, assess, and reduce information security and cybersecurity risks to acceptable levels.

companyName: PREMIER FINANCIAL CORP


text: Our cybersecurity function is overseen by Michael MacLean, Chief Financial and Chief Business Officer, who leads a team that is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Strategy and program oversight We recognize the critical importance of developing, implementing, assessing and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. The Risk Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. Our Chief Information Security Officer is primarily responsible for the implementation of risk mitigation strategies. Our CISO has over 35 years of information technology and cybersecurity experience. He has held the title of CISO and has been in this role since 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications. Our CISO regularly briefs the Risk Committee of the Board of Directors on our cybersecurity and information security posture. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts in addition to our experienced information security team. These external experts include cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry and best practices. Our collaboration with these entities includes regular audits, threat assessments and consultation on security enhancements.

companyName: FB Financial Corp

ticker: FBK


text: Our CTO, James Liao, and senior vice president of the Operating Subsidiary, Ruobing Yu, constitute our cybersecurity incident management team and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CTO has over 25 years in consumer electronics and telecommunication sectors and has a professional background in computer science and engineering, which enables him to oversee our IT systems efficiently.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: The Information Security team, engaged in enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, ensures a complete approach to safeguarding the confidentiality, integrity, and availability of sensitive information. The Information Security team consists of experienced information security professionals and is led by the CIO. The CIO has more than 25 years of information technology and banking leadership experience and holds a Certified Information Systems Security Professional ("CISSP") designation. Reporting to the CIO is the Information Security Manager who has more than 10 years of cybersecurity experience in the Financial Institution industry and possesses a master's degree in information systems management with an emphasis in cybersecurity. Complementing the independent Information Security team, is the Information Technology (IT) team. The IT System Administration & Engineering Manager has over eight years financial institution technology experience and a master's degree in information systems management with a cybersecurity management specialization and the Systems Support Manager has over 20 years of financial institution technology experience, ensuring technology operations occur with a security-focused mindset. In addition to experienced information security and information technology teams, the Company engages with industry experts for managed security services. This collaborative effort includes threat intelligence gathering, firewall management, intrusion detection system monitoring, intrusion prevention services, and security information and event management monitoring, ensuring round-the-clock protection.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with other members of senior management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Due to our structure as a REIT, the cybersecurity program, processes and strategy described in this section are limited to the corporate systems, information and service providers belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. Our Operating Partnership and its subsidiaries lease the hotel properties to XHR Holding, the Company's taxable REIT subsidiary, which engages third-party independent hotel management companies to operate and manage all aspects of the hotels; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to guest reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the property operators, managers and franchisors, and we must instead rely on such operators', managers' and franchisors' programs and processes to protect the properties in which we invest from various risks from cybersecurity threats.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: We engage third parties to perform regular reviews of our security controls which includes 24x7x365 security incident and event management (SIEM) as well as vulnerability services and penetration testing. Our processes to identify, assess and manage material risks from cybersecurity threats include risks associated with our use of third-party service providers, including cloud-based platforms. We oversee and identify cybersecurity risks from our third-party service providers in a number of ways, including appropriate due diligence in connection with new third-party service provider onboarding, robust security terms and conditions in our third-party service provider contracts and ongoing risk-based monitoring to ensure compliance with our cybersecurity standards. We believe that these policies and controls provide us with an appropriate assessment of potential cybersecurity threats.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: In 2023, we conducted our most recent maturity assessment of our use of the NIST Cybersecurity Framework to manage our cybersecurity risk. These assessments measure the extent to which we have implemented the framework's categories and subcategories, but do not specifically assess the effectiveness of our cybersecurity program. Based on these assessments, we develop select improvements to our cybersecurity risk management program to help ensure we maintain a program designed to align to industry benchmarks and financial services peers.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Role of Management management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: To our knowledge, previous cybersecurity incidents have not materially affected the Corporation, its business strategy, financial condition or results of operation. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A. Risk Factors."

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: We rely on a multidisciplinary team including third-party service providers to assess how identified cybersecurity threats could impact our business. The Company's cybersecurity function is managed by the Company's Chief Financial Officer, who assumes the overall responsibility and accountability of the function and with select members of the Company's management is collectively responsible for the day–to–day assessment and management of cybersecurity risks, their prevention, mitigation, detection, and remediation.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Establishing procedures for responding to cybersecurity incidents in a timely and effective manner. This includes notifying appropriate stakeholders, conducting a thorough investigation, and implementing remediation measures to prevent future occurrences.

companyName: HG Holdings, Inc.

ticker: STLY


text: Board of Director's oversight of cybersecurity risks The Board of Directors has oversight responsibility with respect to risk management and reviews matters with management as part of management's regular Board reporting. The Board of Directors has delegated responsibility for information security and cybersecurity risk oversight to the Audit Committee. In accordance with its charter, the Audit Committee discharges these responsibilities through various processes, including the option to use third-party advisers as and when it deems appropriate, and discusses with management the Company's major policies with respect to risk assessment and risk management. The Audit Committee regularly reports the results of these discussions to the Board of Directors. As noted above, the CISO reports to the Audit Committee at each regular Audit Committee meeting on the status of cybersecurity risk assessment, identification and management, as well as reporting information security incidents as they occur, if material, and providing periodic briefings about our information security program, our internal response preparedness, and assessments led by outside advisors. The Chair of the Audit Committee, in turn, reports on these topics to the Board of Directors as and when deemed necessary and/or material. Overall, our Board contains two directors with work experience related to cybersecurity issues or oversight.

companyName: TELOS CORP

ticker: TLS


text: As a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.

companyName: Criteo S.A.

ticker: CRTO


text: Cybersecurity Risk Management and Strategy CRH leverages its Enterprise Risk Management (ERM) framework, which accords with internationally recognized standards, to identify, assess, respond, monitor and report material cybersecurity risks facing the Company. CRH manages cybersecurity risk at multiple levels within the Company. Given CRH's wide geographic spread, the frequency and possible scale of acquisition activity, the diversity of the types of IT systems operated by CRH companies and the decentralized nature of its operations, CRH implements an amalgam of centralized and decentralized processes for IT management. Under this model, Company-level management and the management of CRH's operating companies and business units share responsibility for cybersecurity management and collaborate on assessing, identifying, and managing material risks.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Maintaining a cyber insurance policy that provides coverage for security breach recovery and response; and Engagement of third party consultants to assess the health of our cybersecurity program.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Our process for managing cybersecurity risk is a collaborative effort that includes key members of our information technology, legal, and finance departments, as well as internal audit and third-party cybersecurity firms. Our cybersecurity program takes into consideration the identification of critical data assets, information technology systems, third party service providers, and business processes that may be susceptible to cybersecurity threats. Potential technology vendor relationships are vetted based on the nature of services or technology being provided, and we continue to evaluate these relationships to determine the ongoing necessity of the services and the vendor's risk management posture.

companyName: Five Point Holdings, LLC

ticker: FPH


text: Our cybersecurity risk assessment and risk management processes are managed by certain members of our management, including our CFO (who has prior experience in strategic business operations). Our CFO has supervisory responsibility over IT and cybersecurity functions. Our management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, helping prepare for and respond to cybersecurity incidents, and reviewing security assessments and other security-related reports. Our incident response team is responsible for remediating cybersecurity incidents of which they are notified.

companyName: Annexon, Inc.

ticker: ANNX


text: As of the date of this Annual Report, we are not aware of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, although the Company regularly experiences cybersecurity incidents that are not deemed material to our operations. Examples of cybersecurity threats we face include incidents common to most companies in the energy industry, such as phishing, business email compromise, ransomware and denial-of-service, as well as attacks from more advanced sources, including nation state actors, that target companies in the energy industry. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely disrupt our operations, including our drilling operations, and affect our performance and results of operations. Although we believe we have implemented comprehensive cybersecurity measures, no security program is infallible. For additional information about cybersecurity risks, please see Part I, Item 1A. Risk Factors — Risks Related to our Business and the Oil and Natural Gas Industry — Our business could be negatively affected by security threats, including cybersecurity threats, terrorist attacks and other disruptions.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Board of Directors and Audit Committee Our Board of Directors has delegated oversight of the Company's ERM program, including cybersecurity, to the Audit Committee. The Audit Committee receives updates from our Senior Vice President, Information Technology ("SVPIT") and members of our Information Technology Security Services Department regarding our enterprise-wide cybersecurity programs at least on a quarterly basis. These updates may address data management and security initiatives, significant existing and emerging cybersecurity risks, and any material cybersecurity incidents and their impact on the Company and its stakeholders.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: We at Faraday Future employ a cybersecurity strategy for addressing cybersecurity risks, security vulnerabilities, and impacts that align with the NIST Cybersecurity Framework (CSF). The NIST Risk Management Framework (RMF) provides a comprehensive, flexible, and measurable process to manage information security and privacy risks for Faraday Future systems. This framework outlines standards and guidelines to support the implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA). The NIST framework promotes the protection of Faraday Future infrastructure. We utilize the five core functions of the framework which are Identify, Protect, Detect, Respond, and Recover.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third party CROs, CMOs, or other vendors, contractors or consultants.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: STEP takes a multifaceted approach to managing risk from cybersecurity threats. STEP's cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. STEP's information security program, and supporting policies apply to all employees, contractors and vendors servicing the firm, including employees of the Advisor. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. STEP also undergoes annual SOC 1 Type 2 testing of its financial processes and supporting technical controls. In addition to the foregoing, STEP conducts regular employee trainings on cybersecurity, which trainings apply to the Company's officers and employees of the Advisor, and performs phishing exercises to test employees' understanding of how to identify social engineering attacks. STEP performs diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitors such vendors, including such vendors relied upon by the Company and the Advisor. STEP also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems STEP and its affiliates use. STEP conducts annual penetration testing performed by a rotating group of third-party security firms to test STEP's technical controls and security response. STEP's internal audit team has also conducted a cybersecurity assessment to evaluate STEP's preparedness against potential cyber risks and threats. In addition to its internal cybersecurity capabilities and third-party penetration testing, STEP also, at times, engages consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: Stepstone Private Credit Fund LLC


text: Closure. Occurs when the Company's incident response steering committee can review the security incident and actions taken to evaluate whether proper investigation and documentation have occurred, and the matter requires no further notice or containment. Root causes and steps to prevent future incidents have been identified.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: To more effectively prevent, detect and respond to cyber and information security threats, we maintain a global cyber security risk management program designed to identify, assess, and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity and availability of our critical information technology systems and information. Our cybersecurity risk management program is supervised by a dedicated Senior Director of Cyber & Information Security (the "SDCIS"), who has more than 30 years of experience in cybersecurity and information technology in both private industry and the United States Air Force. The SDCIS is responsible for leading an enterprise-wide cyber security strategy, policy, standards, architecture and processes. The SDCIS reports directly to our Executive Vice President and Chief Technology and Digital Officer (the "CTDO"). For information regarding the relevant expertise and qualifications of our CTDO, see "Information About Our Executive Officers" included in Part I of this report. The cyber risk management program is based on a leading cyber risk controls framework and includes periodic maturity and risk assessments.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: The cybersecurity team leverages tools and systems such as Security Information and Event Management ("SIEM"), for real time alerts and insights.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: The Company has developed and documented an incident response plan that includes various levels of escalation in the event of a cyber incident. All incidents begin with information security and information technology associates, with escalation to a crisis management team comprised of the CISO, the Chief Risk Officer and certain designated members of executive management in the event the situation is severe. The crisis management team communicates with the full executive team and the Board of Directors in case of more severe incidents. More complete reporting is then provided to the ERMC and the Board Risk Committee during regularly scheduled quarterly meetings.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: Our business depends on the availability, reliability and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, physical assets and infrastructure, customer service, product development and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our relationships, or loss of market share.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Our Audit Committee is responsible for oversight of our cybersecurity measures, incident response management and risks related to cybersecurity and technology as well as the steps taken by management to mitigate such risks. Our CSO provides periodic updates to the Audit Committee on the state of our cybersecurity posture, new threats or threat actors that we are monitoring or developing defenses against and any potential areas of improvement. Our CEO, CTO, CSO and General Counsel will also provide ad hoc updates to the Audit Committee and full board of directors, as appropriate, in the case of a material cybersecurity incident, providing them a full briefing of the type and scope of the incident as well as our current and planned mitigation efforts. The Audit Committee has several members with significant direct and indirect cybersecurity experience, including Anthony Werner, the former CTO of Comcast Cable and the company, Paul Gould and Miranda Curtis CMG. Cybersecurity and the effectiveness of our cybersecurity strategy are regular topics of discussion at meetings of our Audit Committee and board of directors.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: The Chief Information Security Officer ("CISO") heads the cybersecurity program which includes personnel based in several of our global locations. Our CISO brings over 25 years of experience, which includes both consulting and practitioner roles, and maintains the following certifications: Certified Information System Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CISO reports to our Chief Information Officer, up to the Chief Technology Officer, who meets with our Board at least annually to discuss cybersecurity risk and related topics.

companyName: AECOM

ticker: ACM