text: Risk Management and Strategy operate in the life sciences sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. We have developed and maintain processes, aligned with industry standards and best practices designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed information technology ("IT")

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Global Technology Acquisition Corp. I

secItem: Item 1C


text: Our CISO and CIO supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as vulnerability assessments, penetration testing, and tabletop exercises.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: SHARING SERVICES GLOBAL Corp


text: Cyber Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. This process is overseen by the Director of IT Operations and Information Security, or the IT Director, and includes periodic security assessments, audits, and testing, which are informed by industry standards and supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. We periodically engage with third parties to support these efforts. We maintain internal information security policies, including an incident response plan, which are reviewed by or at the direction of the IT Director and are updated periodically to reflect material changes and improvement in our information security practices. We have a process to assess and review the cybersecurity practices of third-party vendors and service providers prior to onboarding and periodically throughout the engagement, including through vendor questionnaires and contractual requirements, as appropriate.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: Through the processes described above, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See Part I, Item IA. Risk Factors – "Risks Related to Our Information Technology and Security".

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's Chief Financial Officer and General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party IT and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.

companyName: CervoMed Inc.

ticker: CRVO


text: Our cybersecurity program is headed by our Chief Information Security Officer (CISO), who reports to our Chief Information Officer. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the information security team, several of whom have extensive records of service in financial institutions and cybersecurity. Our CISO has over 20 years of experience in IT operations/security roles in the financial services industry and holds a cybersecurity certification as a Certified Information Systems Security Professional ("CISSP"). Other members of his team also hold CISSP certifications as well as CompTIA Security+, SANS Institute Cloud Security Essentials, SANS Institute GIAC Certified Enterprise Defender, SANS Institute Security Awareness Professional, Certified Information Security Manager, GIAC Certified Incident Handler, Certified in Risk and Information Systems Control, and GIAC Cyber Threat Intelligence certifications.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Vista engages with independent assessors and other third parties to validate security controls, standards, and policies, conduct annual penetration tests of networks and systems to identify threats and vulnerabilities, and assist with forensic analysis of material cybersecurity incidents. In addition, to identify and assess material risks from cybersecurity threats, Vista's enterprise risk professionals collaborate with subject matter specialists, the Vista CISO, and Vista's Chief Compliance Officer ("Vista CCO"), Vista's Chief Operating Officer and Vista's Chief Legal Officer, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and external vulnerability testing. Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: We have developed a comprehensive information security protocol that relies on support from third-party experts and an internal training and awareness program aligned with industry standards and best practices.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our cybersecurity program is ultimately overseen by the Board of Directors (the "Board"). The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources. The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago.

companyName: Woodward, Inc.

ticker: WWD


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.

companyName: Blue Owl Real Estate Net Lease Trust


text: Our Director of Cybersecurity heads the division and is responsible for aspects of cybersecurity across our infrastructure, which includes cybersecurity architecture and engineering, cybersecurity operations, identity governance and IT governance, risk and compliance. Our Director of Cybersecurity has served in various cybersecurity roles for over 20 years at numerous organizations and consulting firms. Our Director of Cybersecurity earned a Bachelor of Business Administration in Management Information Systems (MIS) from Florida International University and a Master of Business Administration (MBA) in Management from Nova Southeastern University and also holds active cybersecurity certifications including the GIAC Certified Incident Handler (GCIH), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP).

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: We regularly evaluate the cybersecurity risks that could affect our information systems, as well as on an ad hoc basis when there is a significant change in how we do business that may increase the exposure of our information systems to such risks. These evaluations include identifying the possible internal and external risks, how likely and harmful they are, and whether our current policies, procedures, systems, and safeguards are adequate to handle them.

companyName: 89bio, Inc.


text: In an effort to detect and defend against cyber threats, the Company annually provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly to the Company's centrally managed cyber defense and security operations.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: Our Chief Information Security & Trust Officer ("CISO") leads our cybersecurity program across the Company and oversees the ISMS. He is supported by our Information Security team, which includes the first responders to cybersecurity incidents. Our CISO provides quarterly updates to the Audit and Risk Committee, as well as an annual report to the Board, regarding the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies, while maintaining the confidentiality, integrity, and availability of information, including user information under our custody. There are also scheduled monthly meetings where, among others, our CISO, Head of Privacy and a representative of the Sponsor attend, in order to discuss our cybersecurity program, including evaluating the implementation of additional controls, processes, policies, and procedures, as appropriate, as well as any notable security incidents, if any. Our CISO joined the Company in April 2024, and has over 20 years of experience in the field of cybersecurity.

companyName: Bumble Inc.

ticker: BMBL


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Chief Financial Officer and Chief Operating Officer are primarily responsible for assessing and managing material risks from cybersecurity threats on a day-to-day basis. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our management team is additionally responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole. We additionally utilizes the assistance of a third-party service provider, an information technology solutions service provider located in Richmond, BC, for purposes of broadly managing its cybersecurity risks.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: We have not historically been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business.

companyName: REGIS CORP

ticker: RGS


text: Execution of the Company's cybersecurity program is delegated by the Board to the Senior Director of Information Security, who has nearly 25 years of relevant experience in information security, including 13 years at the Company, and is further supported by a team of security professionals within the Information Systems & Informatics department. The Senior Director of Information Security reports to the Vice President of Information Systems & Informatics, and they meet periodically with senior leadership and the Board to review metrics on cybersecurity preparedness, incidents, mitigations and remediation efforts. In addition, the Company's internal audit team conducts periodic audits of its systems and cybersecurity processes, with findings reported to the Audit Committee and senior management.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Technical Safeguards—We have deployed technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. We evaluate and strive to improve upon these safeguards through vulnerability assessments and cybersecurity threat intelligence.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Cleco maintains a formal cybersecurity training program for all employees that includes training on matters such as phishing and email security best practices. Employees are also required to complete compulsory training on data privacy. Cleco also provides specialized security training for certain other employee roles.

companyName: Cleco Corporate Holdings LLC


text: Together with our Director of Information Technology, BDO regularly reports to our Chief Operating Officer and General Counsel and to the Audit and Cyber Risk Committee of our Board of Trustees on a quarterly basis.

companyName: LXP Industrial Trust

ticker: LXP


text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk by deploying enhanced detection tools. We conduct cybersecurity penetration tests, purple team exercises, and risk assessments through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various assertions of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security. Our risk-based approach enables us to design and implement cybersecurity programs that are specific to our corporate resources, customer profiles and business network.

companyName: PAMT CORP

ticker: PAMT


text: The Chief Information Security Officer reports to the Chief Operating Officer, has a dotted line to the Audit Committee and the Chief Information Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Company's Internal Audit department, and IT department in order to stay informed on all aspects of cybersecurity risk affecting the Company.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Our cybersecurity strategy and risk management program is a component of our overarching enterprise risk management program and interfaces with other functional areas within the Company, including our business segments, legal, risk, human resources and internal audit departments.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SURGE COMPONENTS INC

ticker: SPRS


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: the obligations of that position as it relates to cybersecurity oversight and risk management will be undertaken by the Company's General Counsel.

companyName: Longeveron Inc.

ticker: LGVN


text: The Company has established a cybersecurity vendor risk management program, which is a cross-functional program that forms part of the Company's Enterprise Risk Management program and is supported by the Company's security, compliance, and third-party partners. Through this evolving program, the Company assesses the risks from cybersecurity threats that impact the Company's third-party service providers with whom the Company shares personal identifying and confidential information. The Company continues to evolve the oversight processes to mature how the Company identifies and manages cybersecurity risks associated with the products or services the Company procures from third parties.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: Our information technology team monitors, identifies, and classifies potential cybersecurity incidents or threats and is responsible for notifying members of the DRM group of such matters as appropriate based on risk to our organization. Upon learning of any material incidents or threats, the members of the DRM group are responsible for informing our executive leadership, other functional teams, and the Audit and Compliance Committee or Board of Directors, as appropriate.

companyName: Premier, Inc.


text: Our cybersecurity program is led by a team of skilled cybersecurity professionals, including dedicated internal cybersecurity resources and external advisors. In the normal course of business, we may collect and store sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We maintain a robust cybersecurity incident response plan, which details the incident response procedures, tactical and strategic team membership, and points of contact related to the response processes. The Company also maintains a detailed decision-tree-based playbook which is a supplement to the plan and focuses on specific types of incidents and the appropriate response steps. Cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach. The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are fully integrated into the Company's ERM program. The plan and playbook are structured to align with the National Institute of Standards and Technology ("NIST") Cybersecurity framework practices. The plan and playbook are reviewed at least annually. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Metallus Inc.

ticker: MTUS


text: Advanced, next-generation endpoint security software, detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Our Board has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Legal and Compliance Oversight ("LCO") Committee and the review of materiality determinations of cyber incidents to the Audit Committee.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: We plan to design our risk management program to also assesses third party risks, and we plan to perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we plan to perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: Our board of directors' audit committee receives annual reports from our CFO concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: SOC/NOC Operations team Our Board is regularly updated regarding the current state of InfoSec, its future roadmap, and any significant or material cybersecurity incidents.

companyName: Rumble Inc.

ticker: RUM


text: We also have a vendor risk assessment process to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. These processes consist of the distribution and review of questionnaires designed to identify cybersecurity risks associated with the engagement of third parties. We also audit cybersecurity practices of certain third-party service providers, and take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data it processes on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards and evaluate them for additional information, product, and physical security requirements.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments and penetration testing to inform our risk identification and assessment. Additionally, we engage external auditors and consultants to assess our internal cybersecurity program and our compliance with applicable practices and standards.

companyName: PROKIDNEY CORP.

ticker: PROK


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors " above.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Blackstone's CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to portfolio companies on technology-related matters.

companyName: Blackstone Infrastructure Strategies L.P.


text: Our cybersecurity risk management program includes: • Ongoing risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Teads Holding Co.

ticker: TEAD


text: The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company's use of information and technology assets and demonstrate effective governance of cybersecurity risk. The CSC is chaired by the CISO, and includes the Company's Chief Financial Officer, General Counsel, CDIO, and other senior representatives from the Company's business segments and functions. The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts. Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.

companyName: Johnson Controls International plc

ticker: JCI


text: We engage external vendors to assess the cybersecurity program as needed. An independent third party, never used consecutively, performs annual multi-stage penetration testing of our IT environment.

companyName: InterDigital, Inc.

ticker: IDCC


text: Perficient's Vice President of Information Technology and General Counsel are active members of the cross-functional team managing the Program. Perficient's Vice President of Information Technology is responsible for Perficient's internally facing technology solutions, infrastructure, and data security team. He has served in similar leadership roles prior to joining Perficient. Perficient's General Counsel is responsible for Perficient's legal and privacy teams. He has over 10 years of experience in the technology sector which includes substantial experience in cybersecurity-related matters. These members of Perficient's senior management team oversee day to day risk management activities performed by the Company's IT Infrastructure, Data Security, and Data Privacy colleagues and participate in annual simulated data security/privacy exercises. The VP of Information Technology and General Counsel also regularly brief other members of the Company's senior management team and the Board, either as a whole or through its Audit Committee, which is charged with oversight of the Program. These briefings occur at least quarterly and address the Program's operations, management of cybersecurity risks, and any potential impact on Perficient's operations and financial stability.

companyName: PERFICIENT INC


text: We maintain a cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across the Company. We also conduct "tabletop" exercises, including exercises facilitated by third parties, during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cybersecurity incident response plan. These exercises are conducted at both the technical level and senior management level and have included participation by members of our Board.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: In addition, the Company has annual third-party, internal and external facing cybersecurity and information technology audits performed, and more frequently, as appropriate. SilverBow relies on continuous security monitoring and conducts penetration testing and vulnerability scanning assessments as part of its cybersecurity program. All employees are trained on cybersecurity as part of their onboarding, and the Company offers additional cybersecurity training to its employees through internal and external resources.

companyName: SILVERBOW RESOURCES, INC.


text: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate periodically in required training, including phishing, spear phishing and other security and awareness training.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Industry-Standard Frameworks and Policies. We incorporate industry-standard frameworks, policies, and practices such as ISO 27001 which are designed to protect the confidentiality and privacy of information.

companyName: Ingevity Corp

ticker: NGVT


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 12 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its Chief Compliance Officer, Chief Operating Officer, Chief Credit Officer, President & Co-Portfolio Manager, Chief Financial Officer of Management Company and Chief Financial Officer of Investment Funds, who acts as chairperson of the ORC. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses, and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of risk factors entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our products and services."

companyName: Peraso Inc.

ticker: PRSO


text: We engage auditors and other third parties in connection with our risk assessment processes. These service providers assist us to monitor, enhance and test our safeguards.

companyName: HARMONIC INC.

ticker: HLIT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, lab equipment, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or Information Systems and Data.

companyName: Equillium, Inc.

ticker: EQ


text: Our cybersecurity program is overseen by our head of human resources, information technology (IT) and facilities, who manages our third-party providers of IT services. We have engaged contractors to provide cybersecurity standards, architecture and processes. As part of our service agreement with our contractors, we receive identification and reporting of risks to our management and board. Our information technology team maintains a security operations center intended to identify anomalous activity.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: We leverage NIST guidance to inform our process for conducting the security risk assessment. The risk management program and processes can be described in four steps: (i) frame risk; (ii) assess risk; (iii) respond to risk; and (iv) monitor risk.

companyName: EQUIFAX INC

ticker: EFX


text: In addition, we also have business processes to provide for critical data and systems availability, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: We recognize the importance of cybersecurity risk and the protection of information across our enterprise and have been working towards the integration of our processes for assessing, identifying, and managing risks from cybersecurity threats into our overall risk management system. As further described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information as well as personal information in our computer systems and networks.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: We use security assessments, penetration testing, and table-top or red teaming exercises with third parties to assess our security posture and to continuously improve our processes. We also use our Internal Audit function to conduct additional reviews and assessments. Our third-party service providers are subject to security risk assessments at the time of onboarding, on a continuous basis and upon detection of an increase in risk profile. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and to investigate security incidents that have impacted such providers, as appropriate.

companyName: CONSTELLIUM SE

ticker: CSTM


text: We maintain a cybersecurity and information security program, which leverages best practices and standards. Risks from cybersecurity threats are regularly evaluated as part of our broader risk management activities and as a fundamental component of our internal control system. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers.

companyName: EXELIXIS, INC.

ticker: EXEL


text: We recognize the critical importance of maintaining the trust and confidence of our business partners, such as CROs, clinical trial investigators, patients, employees, subcontractors and other vendors. We are committed to protecting the confidentiality, integrity and availability of our business operations and systems, and its board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an essential element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents should they occur.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: We are subject to various cybersecurity risks and continuously monitor and assess our cybersecurity measures to protect against a multitude of cyber threats from adversaries, including nation state actors, that target critical infrastructure sectors such as the defense industrial base. A cybersecurity incident impacting us or our subcontractors or suppliers could materially adversely affect our operations, performance, and results.

companyName: Science Applications International Corp

ticker: SAIC


text: We plan to strategically incorporate cybersecurity risk management into all our comprehensive risk management framework, fostering a corporate culture that prioritizes cybersecurity at all levels. This integration shall be done in stages so as to guarantee that cybersecurity factors are ingrained in our decision-making processes throughout the organization. We plan to incorporate a risk management team to collaborate closely with the IT department, consistently assessing and mitigating cybersecurity risks in alignment with our business recognize the intricate and ever-changing nature of cybersecurity threats. To address this, we shall collaborate with external experts, including cybersecurity assessors and consultants. This cooperation shall involve regular audits, threat assessments, and consultations to enhance our security measures. These efforts ensure that our cybersecurity strategies adhere to industry best practices and remain effective in safeguarding our systems.

companyName: SEATech Ventures Corp.

ticker: SEAV


text: The CISO reports to Key's Chief Information Officer who oversees all of Key's shared services for technology, operations, data, servicing, cyber and physical security, and corporate real estate solutions. Our Chief Information Officer, who has served in the role since 2012, has extensive experience overseeing technology and operations delivery for critical enterprise functions and has held various leadership roles during her over 30-year career in the financial services industry.

companyName: KEYCORP /NEW/

ticker: KEY


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Together with the MSP, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Our management team holds a regular cybersecurity and business continuity reviews to evaluate data security exposures, control effectiveness and necessary remediation actions. The Systems Application Manager is also supported by a third-party information technology consulting services provider who helps oversee our information technology systems and provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents.

companyName: OLB GROUP, INC.

ticker: OLB


text: Additionally, we regularly provide associates with information security awareness training covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to a company's network, result in the theft of user credentials and, ultimately, place client or employee data, or other sensitive company data, and information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails. We regularly test associates to determine their susceptibility to phishing emails. We require susceptible associates to take additional training and provide regular reports to management. We additionally maintain procedures for the safe storage and handling and secure disposal of sensitive information.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We believe that we have implemented a comprehensive cybersecurity program aimed at identifying, monitoring, and mitigating cybersecurity risks to the best of our ability. Our security program encompasses information security responsibilities, incident response, and is diligently managed by our information technology consultants. Cybersecurity is integrated into our overall risk management framework, with consultation from our subject matter experts to assess and address potential cyber risks and their impacts.

companyName: EXOZYMES INC.

ticker: EXOZ


text: ATSG management has overall responsibility for assessing and managing risks from cybersecurity threats to our operations. Management has a supervisory team that consists of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Vice President and Controller, and the Vice President of Information Technology, which meets regularly. The Vice President of Information Technology has primary responsibility for the execution of our cybersecurity risk management program and keeps the broader team informed about the detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of Information Technology and the Company's other information technology and security department personnel include individuals with advanced university degrees in cybersecurity and years of technology management experience in matters such as conducting threat assessments, cyber mitigation and incident response.

companyName: Air Transport Services Group, Inc.


text: The Board of Directors is provided regular updates on the Company's cybersecurity program. The Audit/Finance Committee of the Board of Directors oversees the Company's risk management program, including cyber and information security. The Board of Directors is also regularly briefed on Carpenter Technology's cybersecurity risks and mitigation efforts. The oversight of our cybersecurity risk is integrated into our Enterprise Risk Management ("ERM") process owned by management and facilitated by Carpenter Technology's Internal Audit department. The ERM program includes an annual risk prioritization process designed to identify key enterprise risks. Each key enterprise risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The annual risk assessment is presented to the full Board of Directors at least once per year, with regular updates presented quarterly to the Audit/Finance Committee.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and are not aware of any cybersecurity incidents at third parties with whom we conduct business that may have impacted us.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: The Program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner. Our Program consists of a layered cybersecurity approach and is incorporated into our overall ERM program.

companyName: BROOKLINE BANCORP INC


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.

companyName: Wenyuan Group Corp.

ticker: WYGC


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the completion of a vendor security questionnaire and our implementation of vendor monitoring programs. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Board Oversight and Governance Our management is responsible for identifying the various risks facing the Company, formulating risk management policies and procedures, and managing the Company's risk exposures. Our Board responsibility is to monitor the Company's risk management processes by informing itself concerning our material risks and evaluating whether management has reasonable controls in place to address the material risks. The Audit Committee of the Board is responsible for discussing with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures, including the Company's risk assessment and risk management policies. Accordingly, our internal risk management team regularly reports to the Audit Committee on our major risk exposures and the steps management has taken to monitor and control such exposures, including our risk assessment and risk management policies. The Audit Committee, in turn, reports on the matters discussed at the committee level to the full Board.

companyName: FAIR ISAAC CORP

ticker: FICO


text: Cybersecurity is an important part of our risk management processes and an area of focus for our management. Our Chief Financial Officer ("CFO") oversees the leaders from our information security, compliance and legal teams who are responsible for our cybersecurity risk management and strategy processes. Our CFO, together with these individuals, also oversee the work of our third-party consultants. These individuals have significant prior business experience in compliance and risk management. Specifically, our CFO has more than 25 years of experience in all aspects of corporate controllership including managing operating and organizational risk developing, executing and maintaining robust internal control environments, including cybersecurity risk and cash controls as part of several pharmaceutical company operations. Our CFO, as well as our management team, are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee and overall board of directors on any appropriate items.

companyName: Journey Medical Corp

ticker: DERM


text: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition.

companyName: Vertiv Holdings Co

ticker: VRT


text: As part of our cybersecurity risk management, we have established controls and procedures to guide the Company through an active threat or incident to the recovery of normal business, following industry-standard data protection standards. The controls and procedures provide for the identification, notification, escalation, communication, and remediation of cybersecurity incidents to management, including where appropriate the board of directors, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. We maintain an Executive Cyber Response Team composed of senior leaders across various functions, including our CIO, General Counsel, Chief Accounting Officer and VP Communications. The Executive Cyber Response Team is trained and experienced in managing cybersecurity incidents and meets regularly to practice and refine our processes for incident response, management and escalation through tabletop exercises simulating cyberattacks administered by a legal advisor with extensive experience in cyber investigations, cyber threats and cyber-enabled frauds. The results of such exercises are then reported to management and our board of directors. The third-party legal advisor also assesses and advises on our overall cybersecurity program, reports to our board of directors on a periodic basis and is engaged to provide support in the event an attack or other intrusion were to be successful.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: Reviews are performed by the Company's internal audit team to assess the effectiveness of IT internal controls and compliance with the Company's policies, and any identified weaknesses are promptly addressed.

companyName: DallasNews Corp


text: Our management utilizes a systematic approach to evaluating and determining risk tolerance and prioritizes the safeguarding of our digital assets. The Chief Information Security Officer ("CISO") is the Vice President of Cybersecurity leading our cybersecurity program and reports to the Executive Vice President and Chief Innovation Officer, who serves on the Executive Committee and reports to the CEO. The CISO has a Master of Science degree in Cybersecurity Operations, is certified as an information security professional with the International Information System Security Certification Consortium (ISC2) and International Association of Privacy Professionals, and has over thirty years of leadership experience in technology, systems architecture, and cybersecurity.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Our management team and IT Information Security Group takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: Incident and risk event levels each vary from no (or low) risk to crisis (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., FDIC, FinCEN, SEC), authorities (e.g., F.B.I., Department of Justice), customers, third parties or internal personnel.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with our information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, independent audits, risk assessments and security certifications.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of cybersecurity risks and potential related impacts on the Company, refer to the risk factors in Part I, Item 1A. "Risk Factors," including "If a material cybersecurity or other security breach impacts our services or occurs on our systems, within our supply chain, or on our end-user customer systems, or if stored data is improperly accessed, customers may reduce or cease using our solutions, our reputation may be harmed and we may incur significant liabilities."

companyName: NetApp, Inc.

ticker: NTAP


text: The Risk Committee provides assurances to management and the Board that the Company has identified, and evaluated key risks and implemented mitigating controls, including the Company's Incident Management and Information Security Plan, to assess, identify, and manage cybersecurity risks.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Executive Director of IT and the Associate Director of IT Infrastructure and Security. Our IT Leadership team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our management team, including our VP of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management policies and procedures and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our VP of IT, who has experience across technology-enabled growth, information security, infrastructure, operations and compliance.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Saia contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We consider cybersecurity matters when selecting and overseeing our third party service providers and we administer a standardized information gathering questionnaire to evaluate cybersecurity risk in third parties. We seek to require third parties who could pose significant cybersecurity risk to us to be contractually responsible for the risk and to agree to cybersecurity assessments in connection with new vendor engagements and annually thereafter.

companyName: SAIA INC

ticker: SAIA


text: We have no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Profusa, Inc.

ticker: PFSA


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Muzinich BDC, Inc.


text: Our enterprise-wide approach to risk management is designed to support the achievement of our organizational and strategic objectives and improve long-term organizational performance. Cybersecurity is a critical component of our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by our Board and the Audit Committee of our Board (the "Audit Committee").

companyName: ROKU, INC

ticker: ROKU


text: Our industry has become increasingly dependent on digital technologies to conduct certain processing activities. For example, we depend on digital technologies to perform many of our services, to process and record financial and operating data and to collect and store sensitive data, including our proprietary business information and personally identifiable information of our employees and others. We recognize the importance of assessing and managing material risks associated with cybersecurity threats. We seek to assess, identify and manage cybersecurity risks for our IT environment, leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), through the processes described below: Risk Assessment:

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: security and IT infrastructure management team, responsible for managing our cybersecurity processes, implementing security applications and protocols, monitoring and executing security or network controls, and responding to incidents or threats; cybersecurity training programs and cybersecurity awareness events for employees; incident response plan, including assessing and monitoring potential cyber threats; similar processes or applications to mitigate or manage cybersecurity risk from third-party service providers;

companyName: Avinger Inc


text: To help bring risks from cybersecurity threats within an acceptable range, we address risks through compensating controls or remediation, commensurate with the assessed risk level from such threats. Cybersecurity incidents that are determined to be major are escalated on a timely basis in accordance with our cybersecurity incident response plan.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: As previously disclosed, on June 21, 2023, our wholly-owned subsidiary Umpqua Bank was informed by one of its technology service providers (the "Vendor") that a widely reported security incident involving MOVEit, a filesharing software used globally by government agencies, enterprise corporations, and financial institutions, resulted in the unauthorized acquisition by a third-party of the names and social security numbers or tax identification numbers of certain of Umpqua Bank's consumer and small business customers (the "Vendor Incident"). Other than the information described above, no Umpqua Bank account information was compromised as a result of the Vendor Incident, and no information from Umpqua Bank's commercial customers was involved in the Vendor Incident. On June 22, 2023, Umpqua Bank sent an email to potentially affected consumer and small business customers informing them of the Vendor Incident. In August 2023, the Vendor, on behalf of Umpqua Bank, also sent notice via U.S. mail to the 429,252 Umpqua Bank customers whose information was involved in the Vendor Incident.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Maintain firewall and virus protection software, and two factor authentication logins to servers; and Seek to obtain a cybersecurity insurance policy where part of the above processes, we will engage with third party service providers, beyond our board member, to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.

companyName: GPODS, INC.


text: Throughout the year, we conduct cybersecurity training and awareness for our employees to help identify, avoid and mitigate cybersecurity threats utilizing various delivery methods such as phishing campaigns, training sessions, and informational bulletins.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: The Company engages in the periodic assessment and testing of adherence to the Company's policies, standards, processes and practices that are designed to address cybersecurity risks, threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: LKQ CORP

ticker: LKQ


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with Information Technology controls; user and employee awareness of cyber policies and practices; information systems configuration management; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third party service providers. We also engage a range of third party experts in connection with various security implementation, and maintenance activities related to our cybersecurity program.

companyName: CYPHERPUNK TECHNOLOGIES INC.

ticker: CYPH


text: While we are dedicated to cybersecurity, it is not possible to fully mitigate all technology risks. We are currently unaware of any cybersecurity incidents that have, or are reasonably likely to have, a material impact on our business or operations. However, the ever-evolving nature of attack techniques, along with the increased volume and sophistication of these attacks, means that cybersecurity threats - including data breaches, ransomware, and similar threats - could materially impact our future results. Such impacts could include reputational, competitive, operational, or other business harm, as well as financial costs and regulatory action. For further discussion of how risks from cybersecurity threats could materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A "Risk Factors," which is incorporated by reference into this Item 1C.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats including but not limited to malware, ransomware, and social engineering attacks, password hygiene and incident reporting processes.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part I, Item 1A. "Risk Factors – Risks Related to our Operations", these potential threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in our products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.

companyName: MASONITE INTERNATIONAL CORP


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: BOYD GAMING CORP

ticker: BYD


text: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader risk management system. Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in incident prevention, detection and remediation, led by our Vice President, Information Security (a certified information systems security professional with a degree in computer science and more than 30 years of relevant work experience) and our Chief Operating Officer (a seasoned executive with a degree in industrial systems and decades of product and technology experience, including more than 19 years with the Company). The Information Security team is responsible for identifying, assessing and mitigating cybersecurity vulnerabilities, threats and risks; evaluating and deploying appropriate security tools; and operating a 24x7 security operations center to promptly detect, remediate and prevent security incidents. The team maintains a comprehensive incident response policy that includes prompt reporting of security incidents to a cross-functional working group (including our Chief Operating Officer, General Counsel, Chief Compliance Officer and other security and privacy personnel) in order to ensure that information required to be disclosed by the Company with respect to security incidents is timely identified and reported.

companyName: COMSCORE, INC.

ticker: SCOR


text: Our head of IT has over 21 years of experience building and managing information systems with cybersecurity principles, such as least privileged access, patching and vulnerability management, encryption, etc., as part of a foundation to ensure confidentiality, integrity, and availability. Our head of IT has also served in consulting and architecture roles for cybersecurity and compliance projects ranging from design and auditing systems, red team testing, to compliance audits and remediation for the Sarbanes-Oxley Act of 2002, as amended, and the payment card industry data security standards.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: The Board has delegated primary responsibility for oversight of our cybersecurity risk exposures to the Audit Committee, and the Audit Committee receives routine updates on cybersecurity matters from management. Our Chief Financial Officer, Mr. Paprzycki, oversees our information technology department and has helped to develop our information systems and processes. Our information technology department works closely with Mr. Paprzycki and other members of management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Solid Power, Inc.

ticker: SLDP


text: Our platform was built leveraging guidance from leading industry frameworks to effectively manage and mitigate cybersecurity risks. Our rigorous risk management processes, which include data privacy, product security and information security, are overseen by the audit committee of our board of directors and our internal security committee, and are designed to ensure confidentiality, integrity and availability of our platform. These processes have been integrated into our overall enterprise risk management framework, which is overseen by our board of directors.

companyName: Zscaler, Inc.

ticker: ZS


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program (the "Enterprise Risk Management Program") through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization. The Enterprise Risk Management Program is overseen by an executive committee (the " Executive Risk Committee "), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer. Every year, as a part of the Enterprise Risk Management Program, risks affecting the Company are identified. For 2024, cybersecurity was identified as a risk. The applicable subject matter experts brief the Company's Board of Directors on the status of all top enterprise risks at least once per year. Finally, the Nuclear and Operating Committee of the Company's Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors' Audit Committee.

companyName: ARIZONA PUBLIC SERVICE CO


text: We thoroughly assess potential vendors based on their role and the sensitivity of the IT resources they access. Our vendors follow a consistent risk management process in order to meet our high standards. We select vendors who prioritize data protection and comply with relevant privacy regulations. Furthermore, we enforce strict protocols, including limiting access to necessary information, ensuring data usage is confined to agreed-upon purposes, and mandating the deletion or return of data upon service termination. Through these measures, we collaborate with third-party vendors while implementing controls to safeguard our information.

companyName: RALPH LAUREN CORP

ticker: RL


text: CEL-SCI recognizes the importance of assessing, identifying, and managing material risks from cybersecurity threats. CEL-SCI's policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into its overall risk management system. In this regard, CEL-SCI uses various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, routine employee awareness updates, annual cyber security training, monthly email testing engaging experts and third-party monitoring and detection tools.

companyName: CEL SCI CORP

ticker: CVM


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services and our broader enterprise information technology ("IT") environment;

companyName: CYANOTECH CORP

ticker: CYAN


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates and negotiating with TSH Company regarding the proposed Business Combination. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: INTEGRATED RAIL & RESOURCES ACQUISITION CORP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our broader Information Security Management System ("ISMS"), which is designed to identify, assess, prioritize, and mitigate risks across the organization and to enhance our resilience and support the achievement of our strategic security objectives. Our cybersecurity risk management program includes a cybersecurity incident response plan. The audit committee of our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our interim chief security officer ("CSO"), who reports directly to our Chief Product Officer. The interim CSO and his team are responsible for leading enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our interim CSO has over 25 years of information technology ("IT") and cybersecurity, including the cybersecurity architecture at 23andMe, principle cybersecurity engineering at CA Technologies, and corporate IT management, with nearly seven years in security at 23andMe. He holds industry-recognized certifications in CCSK, CCFE, and ITIL v3. • an information technology vulnerability assessment process that includes internal testing, as well as engages with outside security researchers, for identification, evaluation and management of cybersecurity risks. For example, we conduct tests to identify potential vulnerabilities, such as penetration tests, manage a bug bounty program, conduct table top and red team/purple team exercises to evaluate the effectiveness of our ISMS and cybersecurity practices. • a Security Incident Response plan pursuant to which our interim CSO and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with our defined Privacy and Security Incident Response plan, which is reviewed along with other plans relevant to our cybersecurity risk management on an annual basis. • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data. • a training program pursuant to which we provide staff with timely relevant security topics, which include social engineering, phishing, password protection, protecting personal data, appropriate use of assets, and • an annual certifications program by an accredited third-party auditor for compliance with ISO/IEC 27001:2013 for an ISMS, ISO/IEC 27701:2019 for a PIMS as well as the requirements and control implementation guidance within ISO/IEC 27018:2019 for cloud computing.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Process for Identifying Material Cybersecurity Incidents Potentially material cybersecurity incidents are escalated according to our Security Incident Management Policy to a management response team comprising our EVP of Internal Operations, Chief Financial Officer, Chief Accounting Officer, General Counsel, Chief Privacy Officer, and Associate General Counsel (Corporate). Our Security Incident Management Policy is designed to inform the management response team about, and monitor, the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management response team is responsible for timely determining materiality and overseeing the appropriate reporting of certain cybersecurity incidents.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: A third-party Security Operations Center ("SOC") partner to monitor, manage and respond to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cyber risk management process for service providers, suppliers, and vendors that have access to our critical systems and information managed through the selection of typically larger well-known providers, which is supplemented by review of contractual arrangements, insurance and information requests; cybersecurity awareness training and phishing campaigns for specific employee groups; disaster recovery plans/procedures;

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: To protect our systems and applications, we maintain endpoint security protection on all employee laptops and desktops, including industry-standard firewalls, monitoring, and intrusion detection practices. We require multi-factor authentication to access our critical systems and applications.

companyName: Vynleads, Inc.

ticker: VYND


text: Third parties with which the Company does business, that facilitate the Company's business activities (e.g., vendors, supply chain, exchanges, distributors and service providers) or that the Company has acquired are also sources of cybersecurity risk to the Company. Third party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could have a material adverse effect on the Company, including in circumstances in which an affected third party is unable to deliver a product or service to the Company or where the incident delivers compromised software to the Company or results in lost or compromised information of the Company or its clients or customers. The Company does not have processes in place to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers and vendors.

companyName: AIRWA INC.

ticker: YYAI


text: For a discussion of how risks from cybersecurity threats affect our business, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K. As of the date of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to have a material adverse effect on us, our business strategy, results of operations, or financial condition.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: In addition, the group, under the leadership of the CCO, undertakes the appropriate internal notifications of any such occurrence, and responsive activities, to the General Counsel, Chief Executive Officer, Chief Financial Officer and Board of Directors, with executive management involvement in the same to the extent appropriate in the context of the nature of such occurrence.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Senior Manager of IT Infrastructure, Systems and Security, who oversees the ISMS Management Review Team and reports to the Vice President, Head of IT. The Vice President, Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Vice President, Head of IT is responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT role is currently held by an individual who has approximately 35 years of professional IT management experience. The Senior Manager of IT Infrastructure, Systems and Security leads the operational and ISMS oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare employees and third-party service providers to address cybersecurity risks. The Senior Manager of IT Infrastructure, Systems, and Security has approximately 10 years of experience in IT including infrastructure and cloud administration, participation in risk management and incident response activities, vendor management, and ensuring information security policy compliance.

companyName: Vor Biopharma Inc.

ticker: VOR


text: Infinera has implemented a robust third-party risk management program to identify and manage risks to the confidentiality, availability, and integrity of its systems and data. This includes contractual requirements related to data privacy and confidentiality, contractual commitments of third parties to maintain comprehensive security programs, and code of conduct requirements designed to ensure such third parties act ethically, responsibly, and safely. Infinera has also implemented processes to assess the effectiveness of third-party security programs and adherence to Infinera's standards prior to engaging with a new service provider and to monitor performance on an ongoing basis.

companyName: Infinera Corp


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2023. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.

companyName: CNH Industrial Capital LLC


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Chief Information Technology Officer ("CITO") and Chief Information Security Officer ("CISO") work closely with our Enterprise Risk Committee to continuously evaluate and address cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") frameworks.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: In addition, we have established a working group composed of senior leaders from various departments, including operations, finance, IT, information security, audit, and legal. This working group's responsibilities include (i) ensuring that information security goals and objectives are identified, meet organizational and business requirements, and are integrated into relevant processes, (ii) reviewing the effectiveness of the information security program, (iii) providing clear direction and highly visible management support for security initiatives, (iv) providing resources required for information security projects and initiatives, (v) overseeing programs to maintain information security awareness, including training and team-specific guidance, and (vi) coordinating the information security aspects of supplier relationships.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence.

companyName: Apollo Infrastructure Co LLC


text: In addition, our Advisor's information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor's employees to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our Advisor's internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.

companyName: Net Lease Office Properties

ticker: NLOP


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and work with a third party managed service provider to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We and our third-party partners employ a range of tools and services, including regular network and endpoint monitoring and protection, audits, vulnerability assessments, and penetration testing, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Operating Officer.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: They maintain and improve our cybersecurity strategy based on most current industry developments and recent incidents as needed. The Cybersecurity Committee meeting occurs annually, with less formal status update meetings happening more often and as necessary. The members of the Cybersecurity Committee have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the Cybersecurity Committee.

companyName: FlexShopper, Inc.

ticker: FPAY


text: In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation. As cybersecurity incidents occur, including at third party providers, the Director of Information Security leads the Information Security Team through a standardized incident response process that focuses on responding to and containing the threat, minimizing any business impact, and evaluating its severity level. The severity level assessment determines how widespread the incident is and to what degree it could impact our overall business and manufacturing environment. In the event an incident is determined by the Information Security Team to be a high severity level, our cross functional team, with expertise in various disciplines, will assess the incident to determine if it has had a material affect or is reasonably likely of having a material effect on the Company's business strategy, results of operations, or financial condition.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Internal and External Testing We proactively manage our cybersecurity risk by continually seeking to identify and mitigate potential cybersecurity threats to and vulnerabilities in our information and technology assets, with both internal and external assessments, as appropriate. For example, public-facing technology assets are subject to both internal security assessments and external security researcher testing under our vulnerability disclosure and bug bounty programs. Identified threats and vulnerabilities are required to be remediated within stringent timelines, for which compliance and exceptions are tracked in reporting to management and the board of directors.

companyName: VISA INC.

ticker: V


text: Risk Management & Strategy We maintain a robust cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats, which encompasses the following key components.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Our framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. Our cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: The Cybersecurity Steering Committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by the Company; and alerts and reports produced by security tools deployed in the IT environment.

companyName: O-I Glass, Inc. /DE/

ticker: OI