text: Notwithstanding our efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Nor are we insured for damages that could result from such an incident.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: Verizon's comprehensive cybersecurity program is designed to identify and protect against cybersecurity risks and to position Verizon to rapidly detect, respond to, and recover from cybersecurity incidents that impact our company. The program is built on the following pillars: • NIST Cybersecurity Framework - Our program is aligned to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. • Risk identification - We continually assess the cybersecurity threat and vulnerability landscape using various commercial, government and publicly available information sources. • Risk detection - We use both manual and automated detection methods on a scheduled and ad-hoc basis to identify vulnerabilities within, and threats to, our operations and network infrastructure. • Risk evaluation - Once a cybersecurity vulnerability is detected, we assign a threat severity classification based on the risk profile associated with the vulnerability. • Remediation - Verizon's information security team reports all cybersecurity vulnerabilities and their associated threat classification to the appropriate business team for remediation. Deadlines for remediation are set based on the severity of the threat and closely tracked in a central system of record. In the instances when a remediation deadline cannot be met, the information security team and the business team work together to deploy appropriate mitigating or compensating controls until the remediation work is complete. • Metrics and analysis - We track the performance of our cybersecurity program by collecting, retaining and analyzing a broad range of data related to our threat identification, detection and response activity. We use this data to assess threat trends, for strategic planning purposes and to enhance management accountability for cybersecurity.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ

secItem: Item 1C


text: Asset Inventory: The Company maintains an up-to-date inventory of all assets, including hardware, software, data and network infrastructure. Assets critical to the Company's operations have been identified and prioritized accordingly.

companyName: DallasNews Corp


text: Our CEO regularly meets with our CIO to discuss, in part, any significant cybersecurity issues. In addition to the CIO, our Cybersecurity Engineer and the Information Technology team are responsible for the day to day monitoring of the cybersecurity landscape, the Company's monitoring and response processes and training of Company employees. The Chief Legal Officer, Vice President of Network Strategy and VP of Network Engineering may also be involved, as necessary.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview of our cybersecurity threat risk management and strategy processes from our CISO. These sessions typically cover topics such as data security posture, results from third-party assessments, progress towards risk-mitigation-related goals, our incident response plan, and material short-, medium- and long-term risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. In addition, these sessions include a review of the broader threat landscape and how our business may be affected. Cybersecurity threats are also considered during meetings of our board of directors through discussions of enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management and other relevant matters.

companyName: Warner Music Group Corp.

ticker: WMG


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB Incident Response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, finance, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The Director of IT has served in various roles in information technology and information security for 30 years, including serving in technical management and leadership positions in multiple verticals. The Director of IT holds undergraduate and graduate degrees in computer science and has attained several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: As of the date of this filing, we are no t aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.

companyName: J.Jill, Inc.

ticker: JILL


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. We routinely conduct risk and compliance assessments of third-party service providers that request access to our information assets. We re-assess our third-party vendors in an ongoing basis.

companyName: Adeia Inc.

ticker: ADEA


text: Our CISO is responsible for providing information regarding our cybersecurity risk management program, as well as cybersecurity risks and incidents, to a senior management-level cybersecurity steering committee. Within our cybersecurity risk governance model, the steering committee, which includes our CIO, CISO, General Counsel, Chief Compliance Officer, Chief Audit Executive, Chief Human Resources Officer and other senior functional and business leaders, meets quarterly, and more frequently as warranted, to review and discuss, among other things, our cybersecurity risk assessments, prioritization of initiatives, training plans and incident response plan, protocols and testing. This committee regularly provides updates on its discussions and decisions to our Chief Executive Officer.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Our cybersecurity governance framework includes oversight by the Audit Committee of our Board of Directors, which reviews the effectiveness of the Company's management of cybersecurity, data privacy and other data- and technology-related risks, controls and procedures. The CISO reports regularly to our Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our ISMS program is regularly evaluated by external experts with the results of those reviews reported to senior management and the Board. The Audit Committee, and as appropriate, the Board, also receives prompt and timely information regarding any high severity cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Vimeo, Inc.


text: Operational Information Technology and Information Security staff members, and third -party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards, and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported quarterly to the IT Steering Committee, Enterprise Risk Management Committee, and the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.

companyName: Sixth Street Lending Partners


text: The post-incident analysis phase includes evaluating the internal security policies, preparedness, posture, and technical environment, allowing the Company to conduct a holistic assessment and identify and remediate shortcomings and gaps.

companyName: ContextLogic Inc.


text: AGM's Board of Directors is involved in overseeing AGM's risk management program, including with respect to cybersecurity, which is a critical component of AGM's overall approach to enterprise risk management ("ERM"). AGM's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are, in part, based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. See "We rely significantly on information technology and any failure, inadequacy, or security lapse of that technology, including any cybersecurity incidents, could harm us" in the "Risk Factors" section of this Annual Report for further information.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: The Board Technology Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to the overall role of technology in executing the business strategy of the institution, including but not limited to major technology investments, technology strategy, operational performance and technology trends that may affect customers. The Board Technology Committee meets regularly and receives reports from the CTO and the ISO on cybersecurity and information technology risks. The Board Technology Committee reports to the Board of Directors through Committee minutes. The Board's Audit Committee also has oversight responsibility for audits related to information technology, security and information technology governance.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: FRI has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually. Using the NIST framework as a guide, FRI's cybersecurity program is organized around the following program domains:

companyName: Franklin Templeton Holdings Trust

ticker: FGDL


text: While we have not had any cybersecurity incident that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, future cybersecurity incidents or threats could have a material impact on our results of operations or financial condition as discussed in "Risk Factors"—" Increased Information Technology Security Threats and More Sophisticated and Targeted Computer Crime Could Pose a Risk to Our Systems, Networks, Products, Solutions and Services."

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Related to Cybersecurity Risks EastGroup's cybersecurity risk management process is assessed and managed by a cyber risk committee ("Cyber Risk Committee"), which includes the Company's Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and members of management within the information technology, finance and accounting, legal and internal audit functions. The CIO is a Certified Public Accountant ("CPA"), a Certified Information Technology Professional with the American Institute of CPAs and has over 20 years of experience in the areas of cybersecurity and information technology. Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: Information security and cybersecurity incidents undergo thorough review and assessment by the Information Security Subdirector, in collaboration with cybersecurity specialists and experts. Those incidents classified as material are reported to the Technology and Information Security Director, relevant Business Directors, and the Board's Audit Committee, with additional review by AMC's Productivity and Risk Committees. Simultaneously, these processes allow cybersecurity incidents classified as "material" to be promptly disclosed to the SEC in a Form 8-K report within 4 business days of the Company's determination that such incident is in fact a "material" incident.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: We recognize the significance of these threats, sometimes referred to as hacking, cybersecurity fraud, and cyberattacks, and maintains processes and procedures designed to protect our critical systems and sensitive information from unauthorized access. However, there can be no assurance that a cyber-attack would timely be detected or thwarted. To date, we are not aware of any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, and we have not incurred significant operating expenses related to cybersecurity incidents. For more information on risks related to cybersecurity, please see the section titled "Risk Factors" included under Item 1A of this Annual Report on Form 10-K.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could materially impact our business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, we may conduct different amounts of diligence into the cybersecurity practices of the third party, monitor the third party for cybersecurity issues, and impose contractual obligations relating to privacy and cybersecurity onto the third party.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: The IS department is charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. On a day-to-day basis, IS informs the Vice President, Information Security concerning cybersecurity risks and events, including any mitigation and remediation efforts. Our Vice President, Information Security joined the Company in September 2022, and is responsible for approving IS policies and procedures, implementing controls, monitoring and detection programs, and employee training on cybersecurity risks, and reports cybersecurity risks and strategies directly to executive leadership. He has over a decade of security experience, received his Master of Science in Computer Information and Information Systems Security/Information Assurance from Norwich University, and holds various certifications including Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP).

companyName: MEDIFAST INC

ticker: MED


text: The Audit Committee and Risk Committee of the Board of Directors provide oversight of Company cybersecurity risks. The Risk Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company's progress on risk mitigation activities. Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance. The Risk Committee reviews the Company's oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: The cybersecurity program is a part of our broader enterprise risk management program which includes risk assessment, third party risk management, risk mitigation strategy and a clearly defined incident response methodology. The program is led by our executive officers, with support from a working group of senior management with functional and operational expertise.

companyName: Anterix Inc.

ticker: ATEX


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Xencor Inc

ticker: XNCR


text: Oversight of Third-Party Risk We have established processes to oversee and manage risks relating to third-party service providers. For example, our Security Operations Center, employs a Security Information and Event Management ("SIEM") and other systems to monitor risks while also conducting security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Palladyne AI Corp.

ticker: PDYN


text: We and our third-party service providers, such as contract research organizations ("CROs"), collect, process, transmit, and store sensitive data on our systems, including intellectual property, proprietary or confidential business information, and a variety rely on third parties, including cloud vendors, for various business functions. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis. Anebulo's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. In addition, we have implemented procedures over certain areas such as access on/offboarding and account management to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities.

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: The CISO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: Marpai, Inc.

ticker: MRAI


text: The Board regularly discusses our most significant risks and how these risks are being managed. The Board has appointed a Risk Committee, consisting entirely of independent directors, whose responsibilities include assisting the Board in overseeing management's identification and evaluation of strategic enterprise risks, including risks associated with privacy, technology, information security, cybersecurity and cyber incident response and business continuity. The Risk Committee regularly updates the Board on these activities.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: The Board of Directors has primary oversight of risks from cybersecurity threats. The Board of Directors delegates oversight of risk, including reviews of cybersecurity and data protection and compliance with cybersecurity policies, to the Audit and Reserves Committee.

companyName: Chord Energy Corp

ticker: CHRD


text: Risks from cybersecurity threats, including as a result of previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: The Cybersecurity Program is supervised by Roper's Vice President of Cybersecurity, who has related experience including cybersecurity, IT, Cloud, and Security Compliance. The Vice President of Cybersecurity has obtained a B.S. in Management Information Systems, a Master's in Business Administration, and a Master's in Management Information Systems. She also maintains the following industry cybersecurity certifications: CISA, CISSP, GSEC, GCED, GSA, and a Boardroom Certified Qualified Technology Expert (QTE).

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Commvault's Board of Directors (the "Board") provides oversight of Commvault's enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee of the Board receives quarterly briefings on the cybersecurity program from the CSO and briefings on the Enterprise Risk Management Committee ("ERMC") from the Chief Trust Officer. The Board is kept apprised of cybersecurity updates through quarterly reporting from the Audit Committee Chair and annual, or as needed, reporting directly to the Board from the CSO.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: The Information Technology Steering Committee is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Information and Operations Officer provide regular reports to the Information Technology Steering Committee and our Board of Directors regarding the Information Security Program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee and our Board of Directors review and approve our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full Board of Directors at each board meeting. The principal individuals on the Information Technology Steering Committee responsible for the foregoing activities are the Chief Information and Operations Officer (Chairman of the Committee); the Information Security Officer; and the Chief Risk Officer. The experience of Chief Information and Operations Officer; Information Security Officer; and Chief Risk Officer are as follows: 35 years of experience in bank operations, systems development, payments, and information technology in Financial Services sector; 20 years of information security experience in the Banking, Government, Military, Energy, and Insurance sectors; and 29 years of experience in audit and risk management in the Financial Services Sector (banking) as an FDIC Examiner; Internal Audit Director; and Chief Risk Officer, respectively.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: The Adviser employs a proactive and risk-based approach to assess, identify, and manage material cybersecurity risks. Under the leadership and direction of the Chief Information Security Officer ("CISO"), the cybersecurity program is structured around industry-leading frameworks, including the National Institute of Standards and Technology; MITRE Adversarial Tactics, Techniques, and Common Knowledge; and International Organization for Standardization 27001 (Information Security Management System standard) ensuring a comprehensive risk identification process.

companyName: Antares Strategic Credit Fund


text: We will continue to invest time, effort and financial resources to secure our systems, networks and communications. However, our security measures cannot provide absolute assurance that we will be successful in preventing or responding to all cybersecurity attacks. There can be no assurance that any breach or incident will not have a material impact on our operations and financial results. See Item 1A, "Risk Factors-Interruption, failure or breach of OSG's information technology and communications systems could impair its ability to operate" for a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: OVERSEAS SHIPHOLDING GROUP INC


text: We deploy technical defenses against cybersecurity risks of attack and other incidents, including firewalls, intrusion detection and prevention systems and access controls. We refine these measures based on our ongoing assessments, including cybersecurity threat intelligence updates.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Our CTO provides relevant cybersecurity and information technology reports to the Audit and Finance Committee, and to the executive and senior leadership teams. These reports are provided at quarterly Audit and Finance Committee meetings and at our Digital Quarterly Business Review ("Digital QBR") meetings. These reports typically include analyses of recent significant cybersecurity threats and incidents at the Company and across the industry, as well as a review of our security controls, assessments and program maturity, top risks, risk mitigation status, and a review of our third-party service providers as appropriate. Simpson's information security roadmap and posture are also reviewed quarterly with members of the executive leadership team and the Audit and Finance Committee. In accordance with our information security program, any information security event is assessed and reviewed by our Digital Leadership team and members of the executive leadership team.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: Mandatory cybersecurity training is conducted eight times a year for all of AMETEK's employees with email access. The training provides critical information on how employees can protect themselves and AMETEK against cybersecurity risks. AMETEK financial professionals receive additional training due to the nature of their roles.

companyName: AMETEK INC/

ticker: AME


text: To aid our cybersecurity risk management strategy, we contract with dedicated third-party firms and assessors to identify risks and threats to our organization. These assessments adhere to leading cybersecurity standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework aligning with industry best practices. Additionally, our organization adheres to compliance with the Cybersecurity Maturity Model Certification (CMMC) and is undergoing International Organization for Standardization (ISO) accreditation, further demonstrating our commitment to adhering to rigorous cybersecurity standards. To oversee incident response and mitigation we utilize our incident response plan and processes to standardize our processes for assessing, identifying, and managing cybersecurity incidents. This includes a comprehensive reporting structure and analysis processes to provide visibility and determine incident business impact. Were a cybersecurity incident to occur, we have also implemented a cross-functional business team to aid in the determination of incident impact, severity, and materiality, with the support of standing external counsel and third-party incident response advisors. Additional to our third-party incident response advisors and support contracts, we undergo regular penetration tests to bolster our readiness in the event of cybersecurity incidents. Furthermore, we have also obtained cybersecurity insurance coverage to enhance protection and minimize potential financial losses arising from cyber threats.

companyName: EnerSys

ticker: ENS


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our cybersecurity leadership team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

companyName: CSI Compressco LP


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.

companyName: BlackRock Finance, Inc.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Director of Information Security, Chief Financial Officer and Chief Legal Officer. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, Certified Professional Hacker. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members and other relevant subject matter experts report to the Audit Committee of our Board of Directors, as well as the Cybersecurity Subcommittee of the Audit Committee, about material cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: PINTEREST, INC.

ticker: PINS


text: At the executive and management level, the CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program. The CIO has 19 years of experience in technology risk management, 11 of which have been with the Company (or its affiliates), and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor. In addition to the CIO, the Company's information security team under the direction of the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Information security processes include escalation of certain risks and incidents to the CIO and the executive team, with monthly scorecard and quarterly dashboards also used to update the risk landscape.

companyName: Uniti Group LLC


text: We have also established a process whereby potentially material cybersecurity incidents are escalated to a Cybersecurity Disclosure Committee ("CDC") consisting of our CEO, CFO, Vice President and General Counsel, Vice President of IT and Corporate Controller. The Cybersecurity Disclosure Committee is tasked with evaluating whether such incidents have material impact on the Company, and thus require disclosure, as well as any other actions that may be appropriate in response to the incident. The CDC promptly notifies the Audit Committee if it determines that an incident is likely to have a material impact on the Company and updates the Audit Committee on a quarterly basis of any incidents that it determined were not material.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not impact the Company's business in a material manner. At the effective date of this Annual Report, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Kingfish Holding Corp


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, and Vice President and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes security certifications in International Information System Security Certification Consortium ("ISC2"), Information Systems Audit and Control Association ("ISACA") and The International Council of E-Commerce Consultants ("EC-Council").

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: The Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Manager's and the Subadviser's information technology security controls and related compliance matters, with the Company's management. The Board receives periodic updates from Prudential's CISO, CIO and/or Operational Risk Management, or their designees, throughout the year. At least annually, the Board, or a committee thereof, also receives updates on cybersecurity matters, including risks facing the Company, the Manager and the Subadviser and, as applicable, certain incidents. In addition to such periodic updates, the Board or a committee thereof may receive updates from management as to our and the Manager's cybersecurity risks and Prudential cybersecurity program developments.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, tenants and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: BriaCell Therapeutics Corp.

ticker: BCTX


text: The Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. In addition, we carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the Collective Controls Catalog, in assessing the threat landscape and continuously monitoring our environment.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: As of the date of this report, we are not aware of any recent cybersecurity attacks that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: The audit committee receives regular reports from the head of our IT department concerning the measures we have taken to monitor and evaluate our cybersecurity threat environment and any cybersecurity incidents that have occurred.

companyName: Kura Oncology, Inc.

ticker: KURA


text: The Company's executive enterprise risk management committee (the "Executive ERM Committee") is tasked with, among other responsibilities, identifying and evaluating operational risks, which includes risks associated with information technology and cybersecurity. The Executive ERM Committee includes senior leaders across business functions, including the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer, Chief Risk Officer and Chief Administrative Officer. The Executive ERM Committee, as part of its comprehensive risk management duties, discusses Company strategies to prevent cyber-attacks and the Company's response and remediation of threats. The Chief Administrative Officer provides a quarterly report to the Risk Management Committee that summarizes cybersecurity risks, relevant events and other items of note identified by management or the Executive ERM Committee. The Executive ERM Committee meets independently of the Risk Management Committee, with a representative from the Risk Management Committee in attendance. Certain members of the Executive ERM Committee are invited to attend and participate in meetings of the Risk Management Committee.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: The Board receives briefings from management on our cyber risk management program on a quarterly basis. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Systems as well as our Vice President of Information Security and Compliance, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The Audit Committee oversees required disclosures in the event of a cybersecurity breach.

companyName: Extra Space Storage Inc.

ticker: EXR


text: While prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF


text: At every regular meeting of the Technology Committee, the CISO provides the Technology Committee with updates and changes to the state, strategy and risks related to the information security program as well as other security news and topics. Further, the Technology Committee and Audit Committee of the board of directors receive quarterly reports from the Chief Risk Officer regarding our risk exposure related to significant information technology and information security practices.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Our Board of Directors has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board of Directors. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board of Directors, as appropriate.

companyName: EPLUS INC

ticker: PLUS


text: Within this portfolio of properties, GE Vernova's subsidiaries operate 91 manufacturing sites, 18 of which are located in the U.S. and 73 are located internationally. The manufacturing facilities are used by GE Vernova's segments as follows: Number of Facilities Power Electrification Total The locations of GE Vernova's manufacturing locations by geographic region are as follows: Number of Facilities Americas Association of Southeast Asian Nations (ASEAN) Europe, the Middle East, and Africa (EMEA) Total In addition to the manufacturing facilities described above, GE Vernova maintains many offices, warehouses, and distribution facilities globally.

companyName: GE Vernova Inc.

ticker: GEV


text: We are in the process of formalizing the Audit Committee's responsibilities to oversee our cybersecurity risk exposure and the steps taken by management to monitor and mitigate cybersecurity risks. Once these responsibilities have been established, the cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk advisory services will brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis. This will include updates on our processes to prevent, detect, and mitigate cyber incidents. In addition, material cybersecurity risks and/or events, should they occur, will be reviewed by the Board, at least annually, as part of our corporate risk oversight processes.

companyName: Sachem Capital Corp.

ticker: SACH


text: Material Effects of Cybersecurity Incidents As of the date of this report, we have not identified any cybersecurity event or risks from cybersecurity threats that, individually or in the aggregate, would materially affect us. Notwithstanding, we, or third parties upon which we relay, may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us or our business strategy, results of operations or financial condition. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology, including, without limitation, the risk factor under the heading " We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively "

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: We have also established a Cybersecurity Committee that meets on a quarterly basis to review and agree on actions to address cybersecurity risks. The Cybersecurity Committee is led by our chief information officer, or CIO, who is a part-time consultant and includes our chief executive officer and chief financial officer. Our CIO, who reports to our chief financial officer, is responsible for the strategic leadership of our cybersecurity programs, identification of cybersecurity risks and the mitigation plans that address these risks. With over 25 years of experience in information technology, the CIO works alongside individuals across other functions, such as clinical operations, legal and quality compliance, to establish and implement our cybersecurity strategy. Our CIO has a bachelor's degree in Technology and an M.B.A. along with over 10 years of experience in information technology in the life sciences industry.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: Monitor Cybersecurity Incidents The Company's cybersecurity incident response plan provides a structured approach to prevent, detect, manage and mitigate a cybersecurity incident. Primary goals are to minimize harm to information technology systems and Company information, reduce recovery time, and ensure the continuity of operations. Internal resources manage and execute the Company's cybersecurity incident response plan with the support of retained external advisors. Plan testing and assessments occur to provide for the ongoing effectiveness against evolving threats. Pursuant to the plan, communication channels and escalation protocols are also maintained to engage and inform internal stakeholders – such as the Cybersecurity Executive Steering Body, corporate crisis management team, and other members of the Executive Leadership Team – of how incidents are prevented, detected, mitigated, and remediated.

companyName: MSA Safety Inc

ticker: MSA


text: FactSet's information security and governance framework is guided by International Organization for Standardization ("ISO") 27002 and System and Organization Control ("SOC") 2 Trust Service Criteria. We also have implemented the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of our board of directors. Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: FRP HOLDINGS, INC.

ticker: FRPH


text: Our process also addresses material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain, our product development partners, or those who have access to sensitive data or our systems. Third-party risks are included within our broader overall risk assessment process, and cybersecurity considerations are considered during the selection and oversight of our third-party service providers.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Playtika Holding Corp.

ticker: PLTK


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.

companyName: BioAtla, Inc.

ticker: BCAB


text: Our program includes the following: • Risk Assessments: Conducting risk capacity evaluations, pressure tests, and gap analyses while formalizing risk tolerance. • Security Team: A team dedicated to managing cybersecurity risks, implementing security controls, and responding to incidents. • External Expertise: Engaging third-party providers to evaluate, test, and enhance aspects of our security controls. • Cybersecurity Awareness Training: Ongoing training for employees, incident response personnel, and senior leadership. • Third-Party Risk Management: Assessing and monitoring vendors, suppliers, and service providers to mitigate risks to our organization.

companyName: AIRGAIN INC

ticker: AIRG


text: The Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our VP IT and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our VP IT and our third-party cybersecurity consultant to review our cybersecurity strategy. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: cross-functional teams responsible for managing the Company's (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The CEO reports to the Board of Directors regarding cybersecurity risks, incidents, and mitigation strategies at least annually.

companyName: INTRUSION INC

ticker: INTZ


text: The Audit Committee is responsible for providing oversight over management's processes to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this risk management process provides visibility and oversight to allow the Board and executive leadership team to make timely, data-driven decisions ensuring that the Company, its employees, investors, and partners are adequately protected.

companyName: US ENERGY CORP

ticker: USEG


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business, including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Part I, Item 1A. " Risk Factors," of this Annual Report.

companyName: EACO CORP

ticker: EACO


text: The Company's Chief Information Officer is primarily responsible for assessing, monitoring and managing our cybersecurity risks. The Chief Information Officer must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks.

companyName: Stran & Company, Inc.

ticker: SWAG


text: Our Audit Committee is responsible for overseeing our cybersecurity and data privacy risks. Our cybersecurity program is led by the Hamilton Company's Chief Financial Officer, who, along with the Hamilton Company's Director of Information Technology who has been with Hamilton for 38 years, provide regular updates each quarter to the Audit Committee regarding this program, including information about the cybersecurity threat landscape, investments in infrastructure and opportunities to protect and enhance the Company's systems and security of products and operations. The also Board receives periodic briefings from management regarding cybersecurity activities and initiatives.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with our ERM function, our Chief Information Security Officer ("CISO"), our Chief Digital & Information Officer ("CDIO") and other members of management involved in cybersecurity risk management.

companyName: Shockwave Medical, Inc.


text: Our cybersecurity risk management strategies represent an integral component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and based on the recognized National Institute of Standards and Technology (NIST) Cybersecurity Framework. We continuously seek to adopt market-leading standards and procedures to protect our tower infrastructure, data, and carrier and consumer information. Key elements of our cybersecurity risk management strategy include:

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Please see the Item 1A. Risk Factor above entitled "Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations" for more information regarding cybersecurity incident risks associated with InfuSystem.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: The Company's Director of IT reports to our CFO and leads the Information Technology team (collectively "the IT Security Team"). The IT Security Team is responsible for the strategic oversight of cybersecurity risk management and strategy including the identification and assessment of cybersecurity threats and incidents. Periodically, they are also responsible, alongside the CFO and senior management, to keep the Audit Committee of the Board of Directors informed and briefed with respect to cybersecurity risks and incidents. Our Director of IT has extensive experience of over 15 years in various IT roles across a range of cyber technologies, processes and strategies and is supported by the IT Security Team and the wider IT team, including the IT Security Manager, to support the Company's cyber risk management processes, including the prevention, detection and mitigation of cybersecurity threats and incidents, and any required response to and remediation of such cybersecurity threats or incidents.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: We also maintain a management governance structure for reviewing and approving changes related to new and existing systems, software and infrastructure design. Any new items that would require a material change must be reviewed and approved by our architecture review board, or ARB. Non-material changes are governed by the change advisory board, or CAB. The ARB and CAB each meet on a weekly basis and take security impacts into consideration during the decision-making process. All changes, whether approved or rejected, are formally documented in our information technology service management system.

companyName: CoreCivic, Inc.

ticker: CXW


text: As part of our commitment to safeguarding our assets and maintaining the integrity of our operations, C3 AI has established a comprehensive cybersecurity risk management program. This program is designed to identify, assess, and mitigate cybersecurity risks that could potentially impact our business operations, customers, and stakeholders. C3 AI employs a multi-layered approach to identify and assess cybersecurity threats. This includes: • Regular vulnerability scanning: We conduct internal and external vulnerability scans of our systems and applications to identify potential weaknesses that attackers could exploit. • Penetration testing: We engage independent security professionals to conduct simulated cyberattacks on our systems to assess the effectiveness of our security controls. • Threat intelligence monitoring: We subscribe to threat intelligence feeds that provide us with real-time information about the latest cyber threats and vulnerabilities. • Risk assessment framework: We utilize a risk assessment framework to categorize identified threats based on likelihood and potential impact on our business operations, financial stability, and reputation. This framework includes third-party vendor risk assessment to manage cybersecurity risks associated with our use of these providers. The third-party vendor risk assessment framework includes the following: Perform due diligence of the vendors' standards, including reviewing security policies, certifications, and third-party attestation and past security incidents. Request vendors to complete security questionnaires and provide any security and vulnerability scans.

companyName: C3.ai, Inc.

ticker: AI


text: While we have experienced and expect to continue to experience cybersecurity threats and incidents, there have been no material incidents incurred to-date at the Company. However, there can be no guarantee that our policies and procedures will be followed in every instance or that those policies and procedures will always be effective. Cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factors in Part I, Item 1A of this report.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Cybersecurity risks are addressed as a component of our enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business. Features of our program include: • periodic risk assessments designed to help identify material cybersecurity risks to our Information Systems and Data; • a security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • a cyber and data security incident response plan that establishes policies and procedures for identifying, managing and recovering from cybersecurity incidents, including escalating tiers of notification depending on an incident's nature and severity; • periodic tabletop exercises with management and other employees to discuss and prepare potential cybersecurity incident responses; • the use of third-party service providers, where appropriate, to assess, test and assist with aspects of our security controls; • a third-party risk management process for our service providers, suppliers and partners; • cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • policies and procedures that relate to cybersecurity matters, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices; and • required privacy and cybersecurity training (including spear phishing and other awareness training) for employees.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Our Security Council, comprised of the Security Leads from each business and led by our CISO, meets on a monthly basis to discuss emerging trends and threats, share cybersecurity practices across our organization and discuss potential issues. Our Enterprise Security Risk Group (the "ESRG"), which is comprised of a cross functional group of leaders from our organization representing legal, finance, human resources, compliance and internal audit and is led by the CISO, meets at least quarterly to review cybersecurity program performance, cybersecurity risks, progress on projects and risk remediation activities. In addition, the Security Leads report on their cybersecurity programs to the CISO and the ESRG on a quarterly basis.

companyName: Post Holdings, Inc.

ticker: POST


text: Our cybersecurity incident response and vulnerability management follow our Information Security and Privacy Policy framework. This framework is designed to escalate certain cybersecurity incidents to certain management members (including the CIO and CFO) depending upon the circumstances. In addition, depending upon an incident's particular facts, the CIO, CFO or their designee report to the Nominating and Corporate Governance Committee of the Board of Directors for certain cybersecurity incidents.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: As part of its risk oversight responsibility and pursuant to its charter, the Audit Committee, in consultation with the Board and the Board's other committees, oversees our policies, strategies, and initiatives for mitigating cybersecurity and information technology risks.

companyName: EOG RESOURCES INC

ticker: EOG


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and portfolio investment information and the steps management is taking to monitor and control these risks. Our Chief Compliance Officer conducts regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues, and also delivers a comprehensive Annual Compliance Report to the Board, which report also addresses cybersecurity matters.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We are regularly subject to attempted cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our business and our overall enterprise risk management program. Like other global companies, we have experienced cyber threats and incidents, although none to date have been material or had a material adverse effect on our business or financial condition. We have a multilayered approach for assessing, identifying, preventing, evaluating, managing and monitoring cybersecurity risks, that is designed to help prevent such attacks and protect our information, systems, assets and operations from internal and external cyber threats and to help mitigate risks of cyber incidents. Our board of directors delegated authority to the risk oversight and sustainability committee to assist in fulfilling its oversight responsibilities with respect to management's identification, prevention, evaluation, management, and monitoring of our critical enterprise risks. The risk oversight and sustainability committee is briefed by our Head of Global IT or counsel on a quarterly basis regarding cybersecurity risks and mitigation strategies. We continually invest in efforts to protect, monitor, and mitigate cybersecurity risks, including through our robust information security function, training and compliance programs, and regular employee training.

companyName: KADANT INC

ticker: KAI


text: The Board of Directors (the "Board") of the Company is responsible for the oversight of the Company's cybersecurity program and recognizes the risks that cybersecurity threats may impose on the Company, its business partners, employees and investors. The Company's IT Director is responsible for overall IT governance, risk and compliance including the Company's cybersecurity program. The Audit Committee of the Board collaborates with the full Board and the IT Director to facilitate alignment of overall IT related controls and processes. We have a formalized IT Security Incident Report process which provides a method to document and communicate details of security incidents to appropriate stakeholders. The Board and the Audit Committee receive periodic briefings on cybersecurity and help set priorities and strategic direction. As part of continuous improvement, our cybersecurity program is being aligned with the NIST Cybersecurity Framework 2.0 to help ensure comprehensive controls and oversight.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents. These include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee in responding to any such incidents.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: The Company's Security and Privacy Steering Committee, which meets on a regular basis, also provides oversight of our security and privacy programs inclusive of defining the security strategy, reviewing risks and risk management strategies, and program performance. The committee (chaired by the VP of Security) comprises a broad selection of Senior Management leaders within the organization. This facilitates enterprise-wide collaboration in aligning cybersecurity objectives with organizational goals.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: The Board of Directors provides ultimate oversight and monitoring of the Program and its policies. The ARC Committee oversee areas like information technology activities, cybersecurity-related risks, and disaster recovery processes. Additionally, management-level technology and security personnel oversee program management and related assessments, while operational committees manage specific cybersecurity-related risks. While not currently experiencing material impacts, the Company acknowledges the existence of cybersecurity risks.

companyName: California BanCorp \ CA

ticker: BCAL


text: Management's role and expertise in assessing and managing material cybersecurity risks Our Information Security team is charged with the responsibility for assessing and managing material cybersecurity risks. That team is led by our CISO. Certifications held by the Information Security team include CompTIA A+, Network+, Security+, Project+, & CyberSecurity Analyst+, eLearnSecurity Junior Penetration Tester, EC-Council Certified Ethical Hacker ("CEH"), Certified Encryption Specialist, Certified Security Analyst, & Computer Hacking Forensic Investigator ("CHFI"), CMMC-AB Registered Practitioner ("RP"), and ISC2 Certified Information Systems Security Professional ("CISSP"). Our CISO's background includes over 17 years of experience in IT and Information Security. His formal education includes a Master's degree in Cybersecurity and Information Assurance and a Bachelor's degree in Computer Forensics. Certifications held by the CISO include CompTIA A+, Network+, & Security+, Microsoft Technology Associate ("MTA"), CMMC-AB RP, ISO 27001 Certified Lead Implementer Professional, EC-Council CEH & CHFI, ISACA Certified Data Privacy Solutions Engineer & Certified Information Security Manager, ISC2 CISSP, and Offensive Security Certified Professional. Our CISO reports to our Chief Information Technology Officer ("CITO"), who in turn reports to our Chief Executive Officer ("CEO"). Each of our CITO and our CEO have extensive experience in cybersecurity matters.

companyName: TELOS CORP

ticker: TLS


text: Management's Role in Assessing Cybersecurity Risk and Directing Strategy At the management level, primary responsibility for assessing and managing cybersecurity threats and material risks rests with our Chief Information Officer (CIO), who reports directly to our Executive Vice-President of Operations. Our CIO has over two decades of experience in information technology and cybersecurity and is a Certified Information Systems Security Professional (CISSP). The CIO leads a team of five other information system professionals, three of whom also have CISSP credentials. Our CIO and cybersecurity team are responsible for understanding, managing, and communicating cybersecurity risk to our management and works with our legal department to oversee compliance with various legal, regulatory, and contractual cybersecurity requirements.

companyName: FRANKLIN COVEY CO

ticker: FC


text: We depend on technology systems, some of which are operated and managed by third parties, to operate our business. Our business is limited to searching for and implementing an initial business combination. As such, we process a limited number of invoices and rely primarily upon third parties for cybersecurity compliance. Only four individuals are involved in our day-to-day operations and those operations are minimal.

companyName: ExcelFin Acquisition Corp.


text: The Company uses data loss prevention, email filtering and web filtering software to ensure malicious data does not enter the Company's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. All Company networks are secured behind firewalls. Additionally, Security Information and Event Management (SIEM) technology, an Intrusion Detection System (IDS), and an Intrusion Prevention System (IPS) are used.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: We use a collaborative, enterprise-wide strategy to address cybersecurity risks and allocate significant resources to our cybersecurity and risk management processes, which efforts are intended to adapt to the evolving cybersecurity landscape and promptly address emerging threats. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework and is organized into five key functions: identification, protection, detection, response and recovery. We regularly assess the threat landscape and employ a layered cybersecurity strategy to prevent, detect and mitigate threats.

companyName: MASTEC INC

ticker: MTZ


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including providing our code of conduct to our vendors and conducting due diligence in connection with onboarding new vendors.

companyName: MARINUS PHARMACEUTICALS, INC.


text: We have also implemented an Incident Response Plan ("IRP"), which provides a set of guidelines on the appropriate responsive actions to take in the event of a cybersecurity incident, depending on the particular facts and circumstances of the incident.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Any failure to maintain the security of the data, including the penetration of our network security and the misappropriation of confidential and personal information, could result in business disruption, damage to our reputation, financial obligations to third parties, fines, penalties, regulatory proceedings and private litigation with potentially large costs. This scenario may also result in a deterioration of customer confidence in us and potentially other competitive disadvantages. As such, a cyberattack could have a material adverse impact on our financial condition and results of operations.

companyName: Ispire Technology Inc.

ticker: ISPR


text: Management Oversight of Cybersecurity Risk Management CIM Group's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO") and representatives from CIM Group's operations, compliance and accounting departments. The Committee is responsible for CIM Group's cybersecurity policy and overseeing the activities of CIM Group's cybersecurity practices, including assessing CIM Group's risks and controls. The Committee is chaired by the CTO and has more than 30 years of experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee has relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and have multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: Although we experience cybersecurity incidents from time to time as part of operations, these incidents have not had, and are not reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risk Factors" on page 24 of this Form 10-K for further discussion of the risks related to cybersecurity threats.

companyName: FARO TECHNOLOGIES INC


text: Kaltura has developed and implemented a cybersecurity risk management program, intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: KALTURA INC

ticker: KLTR


text: The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management, and benchmarking against peers in the industry to validate the Company's security posture. The Company also engages external firms to measure the Company's NIST CSF maturity level.

companyName: Cohen & Co Inc.

ticker: COHN


text: The Company's Senior Vice President and Chief Information Officer also regularly reports to the Company's executive risk management ("ERM") committee, which oversees Company-wide risk at the management level, regarding cybersecurity risks. Members of the ERM committee include our President and Chief Executive Officer.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: We also conduct mandatory company-wide security awareness training and periodic phishing tests and generally seek to promote awareness of cybersecurity risks through regular communication and education of our employees.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—If our information technology systems, or those of the third parties with whom we do business, including our provider clinics, specialty pharmacies or other vendors, lag, fail or suffer cybersecurity breaches, we may experience a material disruption of our services or suffer a loss or inappropriate disclosure of confidential information, which could materially impact our business and results of operations" in this Annual Report on Form 10-K.

companyName: Progyny, Inc.

ticker: PGNY


text: Our program's maturity and operational readiness are regularly evaluated by independent experts using the U.S. NIST's CyberSecurity Framework and penetration tests. Our program, and the results of these independent evaluations and testing, are regularly reviewed by our senior management and members of our Board of Directors.

companyName: BIOGEN INC.

ticker: BIIB


text: The Company has an Information Security Committee (the "Committee") to identify, assess, and manage cybersecurity risks and to implement necessary policies and procedures to mitigate those risks. The Committee also coordinates employee education efforts throughout the year. The Managing Director of Information Technology serves as the Committee chair and the day-to-day manager of the Company's information security management systems. The Committee is comprised of members having expertise in information technology infrastructure, data security, risk management, compliance, and business continuity and recovery efforts. The Committee identifies and assesses risks by understanding and evaluating the Company's systems, processes, data, and controls. This information is then augmented through participation by certain Committee members in industry threat intelligence groups designed to share best practices and emerging threats related to cybersecurity. The Committee also completes a full cybersecurity risk assessment annually, which drives the implementation of policies and procedures as well as the scope of third-party testing. The Committee has implemented a comprehensive set of cybersecurity policies and procedures that follows standards established by the International Organization for Standardization ("ISO 27001"). Included are policies and procedures to oversee, identify, and mitigate the Company's cybersecurity risks as well as cybersecurity risks to the Company associated with its significant service providers and vendors. The Company's cybersecurity policies and procedures have been independently certified by a third-party as compliant with the ISO 27001 standard. The Committee engages multiple third-party experts to perform penetration tests on a periodic basis, and to assess whether these policies and procedures are designed appropriately and operating effectively.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: Our Global IT and Global Security departments are led by our Chief Information Security Officer (CISO), who also serves as the Senior Vice President and General Manager of our Rimini Protect and Rimini Watch solutions. In this role, he is responsible for providing strategic leadership and management of Rimini Street's internal information security and compliance team and programs, the Rimini Protect client-facing security services and solutions, and the Rimini Watch observability solution. Our CISO has over 25 years of experience in IT and security for private and public-sector organizations and expertise in strategic consulting services, risk analysis/risk mitigation, and compliance. Previously, he held roles developing and managing technology and security teams, operations, business development, client-facing programs, budgets, and compliance in highly diverse organizations including the Global 100, defense, healthcare, energy, financial, retail, and education industries. He holds a Bachelor of Science degree in Information Systems with a concentration in Internetworking from Strayer University in Maryland.

companyName: Rimini Street, Inc.

ticker: RMNI


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Financial Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including with respect to risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss, technology and cybersecurity risks and the risk assessment and risk management policies, practices, programs and/or procedures that we have adopted to monitor, control, mitigate and manage such risks. Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.

companyName: Archer Aviation Inc.

ticker: ACHR


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the board as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant enviornements. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Executive VP and Chief Financial Officer evaluates material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: Third-party Engagement in Connection with our Cybersecurity Program We maintain engagements with our cybersecurity legal counsel and forensic services firms, each of which has visibility into current events through its client base. We engage throughout the year with not only our security vendors but also H-ISAC, the FBI's InfraGard, and other communities dedicated to sharing information regarding developing cybersecurity threats.

companyName: Encompass Health Corp

ticker: EHC


text: Further, our IRP establishes a Security Council, which is responsible for providing oversight, direction, and governance of incident response policies and processes and is composed of certain company stakeholders, including our Vice President of Information Technology and our third-party CISO.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident which jeopardizes the confidentiality, integrity, or availability of our information and technology infrastructure and systems, we utilize a regularly tested incident response plan. The plan defines an organized approach to dealing with cybersecurity incidents, and identifies roles, responsibilities and escalation protocols. The plan is designed to provide an orderly response to incidents, minimize impact, initiate appropriate communications internally and externally, and identify recommendations to mitigate future incidents.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: As part of our enterprise risk management program, we use the results of both internal and external information security audits, and data associated with our analysis of cybersecurity metrics within our information technology environment to inform and direct our overall cybersecurity strategy. Each year, we engage auditors to perform recognized standard audits related to cybersecurity, including a System and Organization Controls ("SOC") 2 review to test our information technology system internal controls. In addition, we engage other third-parties, from time to time and on an as needed basis, in the performance of tests and assessments associated with the cybersecurity of our operating environment. We maintain a centrally-managed third-party risk management process that includes a cybersecurity assessment performed during the procurement process and periodically thereafter of third-party service providers that may have access to sensitive information and/or systems, or applications that we have determined to be important to our operations.

companyName: Sterling Check Corp.


text: Related to Cybersecurity Risks Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. Our Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. The Audit Committee receives quarterly reports from our Chief Information Officer ("CIO") on the status of the Company's cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate.

companyName: REPLIGEN CORP

ticker: RGEN


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: We believe cybersecurity is critical to advancing our 21st Century Security vision and enabling our digital transformation efforts. As an aerospace and defense company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, some of which target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we strive to be a leader in the information security field, and we expend considerable resources on cybersecurity.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: We routinely undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents, including an annual risk review, policy reviews and revisions. In addition, we maintain business continuity, contingency, and recovery plans for use in the event of a cybersecurity incident by the administering of local and cloud based back up of files. and emails.

companyName: Stemtech Corp

ticker: STEK


text: Our CIO and our Director of Cybersecurity, who reports in to the CIO, have extensive cybersecurity knowledge and skills gained from over 30 years of work experience at the Company and elsewhere, respectively, and head the team responsible for implementing and maintaining cybersecurity and data protection practices across our business. Reporting to our CIO and Director of Cybersecurity are a number of experienced information security specialists responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals. The CIO and Director of Cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from this team and regularly review risk management measures implemented by the Company to identify and mitigate cyber security risks. The CIO also attends regular meetings of the Technology, Risk and Finance Committee to report information on material risks from cybersecurity threats.

companyName: FLOWSERVE CORP

ticker: FLS


text: WEC Energy Group's CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. WEC Energy Group's CAO has 25 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in WEC Energy Group's IT/OT cybersecurity, data security, and physical security environment and risk profile.

companyName: WISCONSIN PUBLIC SERVICE CORP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer ("CTO"), CISO, and Chief Information Officer ("CIO"), who have decades of experience in cybersecurity and information technology. Our CTO has extensive experience in computer science, and our CISO has extensive experience in computer security and enterprise data.

companyName: PagerDuty, Inc.

ticker: PD


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, regulatory compliance, results of operations, or financial condition. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against Company IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to Company service delivery; however, potential vulnerabilities to known or unknown threats will still remain. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Our cybersecurity program is run by a third-party firm, which reports to our Chief Financial Officer ("CFO"). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CFO regularly reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF