text: Our Board of Directors is responsible for oversight of our cyber-risk management program and management's role is to assist the Board of Directors in identifying and considering material cybersecurity risks, ensure implementation of management and employee level cybersecurity practices and training and provide the Board of Directors with regular reports regarding any cybersecurity attacks or vulnerabilities.

companyName: Tenon Medical, Inc.

ticker: TNON


text: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company and the effectiveness of the Company's cybersecurity program to the Board's Technology and Cyber Committee. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.

companyName: EVEREST REINSURANCE HOLDINGS INC

secItem: Item 1C


text: Cybersecurity risk is evaluated within the population of all enterprise risks in the framework and is included in assessments overseen by the RMC that identify the risks of highest priority to the Company. For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes and monitors risk mitigation and treatment strategies to support business continuity.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Our cybersecurity risk management program is designed to be adaptable in order to respond to an evolving landscape of emerging threats and available technology. Our security controls and cybersecurity risk management program are evaluated through data gathering and analysis of emerging threats from internal and external incidents and technology investments. See Part I, Item 1A. "Risk Factors" for a more comprehensive description of risks related to cybersecurity.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has ultimate oversight regarding our cybersecurity with our audit committee specifically assisting the board of directors in the role of risk oversight by regularly reviewing cybersecurity matters and reporting to the board of directors. The Company's Chief Technology Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters. Cybersecurity risk matters are reflected on reports and updates to operations management, senior management and our audit committee on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. To aid the board of directors with its cybersecurity and data privacy oversight responsibilities, the board of directors periodically hosts experts for presentations on these topics. For example, in 2023, management hosted an expert during the annual board of directors' retreat to discuss developments in the cybersecurity threat landscape. Our board of directors also engages in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT


text: NetApp's CSO, in coordination with the Chief Information Security Officer (CISO) is responsible for leading the assessment and management of cybersecurity risks. The current CSO and CISO each have over 30 years of experience in IT and information security.

companyName: NetApp, Inc.

ticker: NTAP


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to our Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.

companyName: Ventas, Inc.

ticker: VTR


text: Our board of directors oversees the management of our risks from cybersecurity threats. The board of directors has delegated the responsibility for the oversight of our cybersecurity risks program to the Audit Committee. The CISO provides cybersecurity updates to our Audit Committee as needed but at least on a quarterly basis covering cybersecurity matters, including a security scorecard, updates on policies, significant incidents or new developments in our cybersecurity risk profile. Our incident response process contemplates that management will notify the audit committee of a mater ial cybersecurity incident.

companyName: LendingTree, Inc.

ticker: TREE


text: Our Board of Directors oversees consideration of strategic risks to the Company as well as managements actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees. The Company's CISO, Chief Enterprise Risk and Privacy Officer, and Audit Committee Chair of the Company's Board of Directors review the Company's cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary, with each committee chair and other directors (including the CEO) of the Company's Board of Directors, the Company's chief people officer, chief financial officer and general counsel. The Chief Enterprise Risk and Privacy Officer holds similar quarterly reviews with the Company's CEO and executive officers. During these reviews, topics include: • implementation and third-party evaluation of the Company's cybersecurity program, including applicable policies, procedures, governance, and adopted risk management framework; • the impact of cybersecurity and privacy risks on the Company's services, employees, customers, suppliers, vendors and the staffing industry; and • information on global regulatory changes and best practices. In addition to the reports submitted quarterly by the Company's Chief Risk Officer and CISO, the Vice President of Internal Audit independently assesses the Company's risk management process and separately reports on the effectiveness of the Company's risk identification, prioritization, and mitigation processes to the Audit Committee. All board members are kept apprised of its committees' risk oversight activities through reports from the committee chairs presented at regular Board meetings. The Company utilizes a multi-layered approach to prevent and detect cyber threats and has standard operating procedures relating to the identification, incident response and notification and management escalations for security incidents. In line with those procedures, the Company activates an emergency management team (EMT), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities. EMT members for information security incidents would include the CISO, the CIO, and Chief Enterprise Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate. While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.

companyName: KELLY SERVICES INC

ticker: KELYA


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to address unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: b) Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: The Board of Directors is responsible for leading the Company to minimize the risk of unauthorized and malicious use, disclosure, potential theft, alteration or damaging effects on the Company's operations while concurrently enabling the sharing of information in cyberspace. The Board of Directors is committed to ensuring that risks to the confidentiality, integrity or availability of Company-owned information assets are managed appropriately by implementing an information security risk management approach.

companyName: Bit Digital, Inc

ticker: BTBT


text: In addition, we have retained an external consultant to serve as our internal audit function and to support our cybersecurity risk management and governance practices. Our consultant has substantial experience in cybersecurity risk management and information technology, including security, compliance, systems and programming and reports to our audit committee and our board of directors on any appropriate items.

companyName: STAR OPERATING COMPANIES, INC.


text: Security awareness training is provided to educate employees about cybersecurity threats and help them understand their responsibility in identifying, mitigating, and reporting security concerns or threats. Along with other significant risks for the Company, we have sought to integrate cybersecurity into our enterprise risk management framework, by tracking key risk indicators, emerging risks and changes to the risk mitigation plan to achieve desired results.

companyName: Titan Machinery Inc.

ticker: TITN


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: SELECTIS HEALTH, INC.

ticker: GBCS


text: A dedicated team of information technology leaders, led by our Chief Information Officer ("CIO"), plays a pivotal role in managing our enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes, with a continuous focus on improvement. These individuals collectively have decades of experience managing the computing environment and have obtained various professional security certifications and advanced training in the field of cybersecurity and technology.

companyName: DAVEY TREE EXPERT CO


text: The CIDO receives reports from the cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Appropriate procedures for communication to the Audit Committee are also built into the incident response plan.

companyName: HNI CORP

ticker: HNI


text: In the event of a cybersecurity incident, we have policies and processes for detecting threats and managing incident response. We also periodically conduct cross-functional exercises and activities to help detect, assess and respond to cybersecurity incidents, and have relationships with external providers to assist with incident response efforts, as needed. We also seek to contractually require our third-party service providers to notify us in the event a cybersecurity incident within their systems or services impacts our data or operations. We maintain specific coverage to help mitigate losses associated with certain cybersecurity incidents that impact our or our third parties' systems, networks and technology.

companyName: GRAIL, Inc.

ticker: GRAL


text: We have a commercial cybersecurity insurance policy that provides for coverage for losses sustained from cybersecurity incidents, subject to certain deductibles and limitations. However, costs and damages associated with cybersecurity incidents could exceed our commercial insurance coverage which could have a material adverse effect on our business, financial position and results of operations.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance that helps equip them to oversee cybersecurity risks effectively. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework. The CFO reports to the Audit Committee regarding cybersecurity risks and provides a comprehensive briefing to the Audit Committee on a regular basis as needed, with a minimum frequency of once per year. The CFO also maintains an ongoing dialogue with the Audit Committee regarding emerging or potential cybersecurity risks and cybersecurity incidents. The Audit Committee evaluates the materiality of cybersecurity incidents to determine if they require disclosure, such as an 8-K filing. This includes assessing the potential impact of cybersecurity risks or incidents on the company's financial position, operations, and reputation.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: In addition, Carlyle partners with third parties to assess the effectiveness of its cybersecurity program, which includes the Company. Third party assessments will include audits and assessments performed under the direction of Carlyle's internal audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers Carlyle's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: The Cybersecurity Leadership Team continually assesses and discusses the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes that are used to identify, prevent, mitigate and remediate cybersecurity threats and cybersecurity incidents. The Cybersecurity Leadership Team's responsibilities include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Cybersecurity Leadership Team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact of the incident, reporting such events to senior management, and developing strategies for remediation and prevention of future incidents.

companyName: CubeSmart

ticker: CUBE


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;

companyName: VICTORY CLEAN ENERGY, INC.

ticker: VYEY


text: The Funds have established a risk-based cybersecurity framework to manage cybersecurity risks effectively. This framework includes regular assessments of its information systems, physical and virtual infrastructure, and the data therein, to identify potential cybersecurity threats and vulnerabilities. Our cybersecurity strategy is integrated into the Funds' overall risk management processes, with specific consideration given to the confidentiality, integrity, and availability of our information systems.

companyName: VS Trust

ticker: SVIX


text: Evaluation and mitigation of Third-party risks are included within our broader overall risk assessment process. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and where necessary, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Please see the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors.." in Part I, Item 1A. Risk Factors in this report for more information.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors (our "Board" or "Board of Directors") and management.

companyName: DURECT CORP


text: Our audit committee, a subcommittee of our board of directors, has been delegated responsibility for oversight of cybersecurity risk management, which includes reviewing our cybersecurity and other information, technology risks, controls and procedures, including our plans to mitigate and respond to cybersecurity risks. The Head of IT, alongside the Chief Legal and Compliance Officer, and Chief Financial Officer, provide quarterly reports to the audit committee covering cybersecurity and other information technology risks affecting us. These reports may include reviewing our current infrastructure and the status of key cybersecurity initiatives, including the status of ongoing mitigation efforts, providing insights into the latest cybersecurity threats, and discussing any recent security incidents impacting our peer companies. Periodically, or in the event of a critical cybersecurity incident, the Chief Legal and Compliance Officer, and Chief Financial Officer will provide our full board of directors with findings and recommendations from these reports.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Vice President, Information Technology, who is an information technology professional with healthcare and digital certifications and has over 25 years of relevant experience, and other employees in our Information Technology department who are certified security professionals and have relevant experience.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Our business and support functions utilize information systems that provide critical services to both our employees and our customers. We have an integrated team of professionals who manage and support our communication platforms, transaction-management systems, and analytics and reporting capabilities, including the development of proprietary solutions like REMS. We use both cloud-based platforms and services and off-site, secure data centers in North America and Europe for our core applications.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: The Company's Chief Information Officer ("CIO") leads our Information Security Committee (a taskforce comprised of senior representatives from primary corporate functions, mortgage and title operations, IT infrastructure, IT security, and external security consultants, which is responsible for developing, updating, implementing and maintaining our cybersecurity strategy, policy (which leverages the NIST CSF framework), standards, architecture, and processes. The CIO provides annual reports to our Board of Directors, and periodic reports to our Chief Executive Office ("CEO"), Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO"), and other members of senior management, regarding existing and emerging cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, and assessments of our information security program.

companyName: M/I HOMES, INC.

ticker: MHO


text: PTC's Cybersecurity Program is supported by robust processes and procedures at all levels. Our matrixed cybersecurity organization is governed by industry-standard frameworks, and to ensure that they are executed, we involve the Executive Leadership Team, the Cybersecurity Strategy Council, and business unit security leads and cybersecurity analysts across the enterprise. We provide regular updates on our cybersecurity strategic plans, programs, and initiatives, and vulnerabilities and any applicable remediation efforts to the Cybersecurity Committee of the Board of Directors at its four regularly scheduled meetings per year. Our Incident Response Plans provide for notice, and continued updates, to the Cybersecurity Committee of applicable incidents on a timely basis. Ongoing program assessments are performed to monitor progress and identify opportunities for growth.

companyName: PTC INC.

ticker: PTC


text: Our Vice President of IT is tasked with continuous monitoring of our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.

companyName: Celsius Holdings, Inc.

ticker: CELH


text: (5) Debrief and recovery As part of the gathering and assessment of information in step 2, we will consider various factors to make a materiality determination of the incident, including business impact, potential costs, impacted data, scope of the incident, possible litigation or regulatory implications, and reputational damage.

companyName: BALCHEM CORP

ticker: BCPC


text: Our Information Technology team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: The Audit Committee of our Board of Directors is the governance body involved in, and ultimately responsible for, cybersecurity oversight. They will generally coordinate with our Chief Financial Officer in this regard. If needed, the full Board would be updated on cybersecurity risks and incidents. None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: We have never experienced a cybersecurity incident that was determined to be material, although, like many technology-dependent companies operating in the current environment, we have experienced cybersecurity incidents in the past.

companyName: Revolve Group, Inc.

ticker: RVLV


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors – We rely heavily on our information technology systems, as well as those of our vendors, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption or security breach could adversely affect our business, financial condition and operations," the sophistication of cyber threats continues to increase, and the actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. As such, no matter how well our controls are designed or implemented, we cannot assure that we will be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: Risks from cybersecurity threats are among those that we address in our general risk management program. We rely on a multidisciplinary team (including personnel from our information security function, management and third-party service providers, as needed, as described further below) to help identify, assess and manage our risks. We identify and assess such threats by, among other things, monitoring and evaluating the threat environment using various methods, including, for example, manual and automated tools, information security tools and platforms to alert us to potentially unwarranted activity on our networks, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting risk and vulnerability assessments to identify vulnerabilities.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: b. Assessing the likelihood and potential impact of those threats; and c. Assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks. In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.

companyName: S&T BANCORP INC

ticker: STBA


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to "Risk Factors – Risks Related to our Company and Structure – Operational risks, including the risk of cyberattacks, may disrupt our business, resulting in loss or limited growth" in Item 1A of this Annual Report on Form 10-K for an additional description of our cybersecurity risk and the potential related impacts.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.

companyName: NewtekOne, Inc.

ticker: NEWT


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of the Company's information security environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.

companyName: Digital Media Solutions, Inc.


text: Lazard has implemented policies and procedures to protect the firm from any interruptions to the availability of our data and our systems and to protect the firm's and our clients' data from intentional and unintentional disclosure, including disclosure arising from a range of cybersecurity threats. These policies and procedures outline actions to be taken after identifying suspected cybersecurity threats and cybersecurity incidents and designate the persons responsible for managing those actions.

companyName: Lazard, Inc.

ticker: LAZ


text: Our Information Technology and Cyber Security Manager, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities of the Information Technology and Cyber Security Manager include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Information Technology and Cyber Security Manager has over 17 years of experience in information technology and cybersecurity, enabling him to effectively oversee cybersecurity risks and threats. He helped design and implement our initial cybersecurity infrastructure.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: The Information Systems Security Program, reviewed and updated annually by the Board of Directors, is our benchmark for protecting the Company's confidential information. The COO, with over 30 years of experience in operations and information security, reports security incidents and updates to the Board as needed.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: Post-Incident Activity After recovery, the Company performs a review of the incident to identify potential enhancements to the cybersecurity program that can mitigate the risk or severity of future incidents. The results of these reviews are shared with management and the Audit Committee.

companyName: American Homes 4 Rent

ticker: AMH


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company, including the risk factor titled, "If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not secure, our reputation may be harmed, our business operations may be disrupted, demand for our solutions may be reduced, and we may incur significant liabilities". Unity Software Inc.

companyName: Unity Software Inc.

ticker: U


text: On a daily basis, our information technology team monitors, identifies, and classifies potential cybersecurity incidents or threats and is responsible for notifying members of the DRM group of such matters as appropriate based on risk to our organization. Upon learning of any material incidents or threats, the members of the DRM group are responsible for informing our executive leadership, other functional teams, and the Audit and Compliance Committee or Board of Directors, as appropriate.

companyName: Premier, Inc.


text: The CEO meets regularly with the CIO to discuss cybersecurity threats and existing and potentially new technology systems including those related to cybersecurity. The CIO and CISO have a standing monthly meeting with the President and General Counsel to discuss potential vulnerabilities in the cyber environment. The President formerly ran the Information Technology Department at the firm and as a result has significant systems experience including experience related to cybersecurity.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: The implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against today's cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, Wesco has a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the close out of the relationship. This program is designed to ensure our third-party partners adhere to Wesco's security policies and expectations as the threat landscape evolves and the relation between the organization changes. Wesco's cybersecurity programs are reviewed as part of our information security management system ("ISMS") by external, independent third parties and in 2022, we achieved ISO 27001 certification for our ISMS. We conduct mandatory information security awareness training for our employees at least annually and enhanced training for specialized personnel. We have instituted regular attack or malicious activity simulations for employees to enhance awareness and responsiveness to such possible threats, and we also employ third parties to perform penetration and vulnerability tests.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: The audit committee receives periodic reports from senior management concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Legal and Regulatory Risks • investigations, claims, disputes, enforcement actions, litigation (including criminal, civil and administrative) and/or other legal proceedings • changes in procurement and other laws, SEC, DoD and other rules and regulations, contract terms and practices applicable to our industry, findings by the U.S. government as to our compliance with such requirements, more aggressive enforcement of such requirements and changes in our customers' business practices globally • the improper conduct of employees, agents, subcontractors, suppliers, business partners or joint ventures in which we participate, including the impact on our reputation and our ability to do business • environmental matters, including climate change, unforeseen environmental costs and government and third-party claims • unanticipated changes in our tax provisions or exposure to additional tax liabilities

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: In today's digital world, protecting our systems and data from cyberattacks and unintentional or malicious breaches is a priority for our leadership and Board of Directors. Our cybersecurity team is overseen at a high level by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance. This leadership team has decades of experience leading cybersecurity oversight and managing our organization's cybersecurity risks. Team members who support our information security program have relevant educational, industry experience, and technical certifications. The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents the Company has experienced. Directors with experience in cybersecurity and technology play crucial roles in strategy, innovation, and oversight of the Company's technology investments. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats.

companyName: TEGNA INC

ticker: TGNA


text: We are subject to various legal and regulatory requirements related to cybersecurity. Compliance with these requirements is of utmost importance to management, is a top priority for the Company and is a shared responsibility among all stakeholders. We continue to diligently work to ensure our compliance efforts align with these obligations, and we are committed to ongoing efforts to enhance our cybersecurity measures and stay vigilant against evolving threats.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Management's risk oversight is also accomplished through the Company's Strategic Risk Management Committee and Operating Risk Management Committee, which provides cross-functional support for cybersecurity risk management, as well as the Company's Chief Compliance Officer.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology who has more than 20 years of experience in IT and cybersecurity. She holds many industry certifications in areas including Security Management and Cybersecurity and IT Service Delivery. Her previous positions include work in Security Operations Centers supporting enterprise corporations' security infrastructure and implementation and troubleshooting of network and security appliances.

companyName: CHIMERIX INC


text: Cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and advisors, and oversight from our Board, regularly performs an enterprise-wide risk assessment to identify key existing and emerging risks.

companyName: Cencora, Inc.

ticker: COR


text: The Company's policies and practices are based on frameworks and standards that address risks through a comprehensive, cross-functional approach that assess, identify, monitor, and mitigate material risks from cybersecurity threats as part of the overall enterprise risk management ("ERM") process. This includes the collection and storage of data and being responsive to incidents as they occur. Further, the Company's processes and technology are utilized to develop, implement, and maintain appropriate measures to safeguard information systems in protecting the integrity, availability, and confidentiality of data. Additionally, the Company engages certain third parties to assist in network monitoring and control testing, among other functions of similar capacity.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: At the management level, our CISO leads the team responsible for implementing, monitoring and maintaining information security, including data protection practices across our business. Our CISO receives reports on cybersecurity threats from both our internal personnel and external partners on a regular basis. Our Chief Operating Officer and Chief Financial Officer receive regular reports from our CISO on the information security program and measures implemented by the Company to identify and mitigate cybersecurity risks. Our CISO works closely with our legal team to ensure compliance with legal and regulatory requirements related to cybersecurity. Our CISO has over a decade of cybersecurity and risk management experience and holds CISA, CISM and CISSP certifications as well as a bachelor's degree in Business Information Systems.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: At the management level, our cybersecurity program is managed by our Head of Information Security & Compliance who reports to our Chief Information Officer. Our Head of Information Security & Compliance has over 30 years of IT security experience.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: We conduct periodic risk assessments, including vulnerability scanning and penetration testing, to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include an inventory of assets, followed by identification of reasonably foreseeable internal and external vulnerabilities, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Cricut, Inc.

ticker: CRCT


text: Cybersecurity Risk Management and Strategy 8x8 maintains a global cybersecurity risk management program aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This program is integrated and embedded within the Company's overall enterprise risk management, or ERM, process and designed to proactively identify, assess, and manage cybersecurity threats that could materially affect our business operations, financial condition, or reputation.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Employees receive ongoing annual education and training regarding relevant cybersecurity risks and practices, including how to protect information and systems from cyber threats. We also conduct monthly phishing simulations to increase employees' ability to detect and prevent such threats. Through our internal social media channel, we provide cybersecurity alerts and education. In addition, our policies require the use of a cyber risk management process to onboard new suppliers and other third parties.

companyName: Xylem Inc.

ticker: XYL


text: Our process for assessing, identifying, and managing material risks associated with cybersecurity threats, including risks related to disruptions to our operations, compromise of our intellectual property rights, data privacy, litigation and other legal liability and reputational impacts, is an important component of our overall enterprise risk management process. As part of this process, both corporate and operating company leaders collaborate with subject matter experts to identify and assess cybersecurity threats and implement relevant countermeasures. In addition to this component of our overall risk management process, we have separate cybersecurity-specific risk assessment and management processes that are managed centrally and executed at both the corporate and operating company levels. These processes, including corresponding controls, are designed to help us protect against, detect, and respond to cybersecurity threats, and to manage business continuity, the availability of critical systems, product security, disclosure controls and procedures, escalation, and regulatory compliance in the event of any cybersecurity disruption.

companyName: Fortive Corp

ticker: FTV


text: Our CISO has more than 30 years' leadership experience in the field of information technology, cybersecurity, and adjacent roles spanning both military, corporate, and advisory roles. He maintains multiple professional certifications and has completed various academic and professional training courses, including the Federal Bureau of Investigation CISO Academy. In addition, he continues to serve on cybersecurity advisory councils and on the faculty of educational institutions focused on network security and information technology.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: By strategically embedding cybersecurity risk management within our broader risk management framework, we foster a company-wide culture of cybersecurity awareness. This integration ensures that cybersecurity considerations are a fundamental part of our decision-making processes at all levels. As a holding company, the Company's board of directors and management work closely especially with IT department from our subsidiary Macao E-Media Development Company Limited ("MED"), to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: The Technology Committee, comprised of independent Board members, is responsible for reviewing cybersecurity, privacy, data protection and other major technology risk exposures of the Company, the steps management has taken to monitor and control such exposures, and the Company's compliance with applicable cybersecurity and data privacy laws and industry standards. These reviews are provided at least annually. The Technology Committee receives management updates and reports, primarily through the Company's Cybersecurity and Privacy Committee, a multidisciplinary team responsible for the overall governance, decision-making, risk management, awareness and compliance for cybersecurity and privacy activities across the Company.

companyName: DEXCOM INC

ticker: DXCM


text: For additional information regarding cybersecurity risks, see the risk factor captioned "Cybersecurity incidents may threaten our confidential information, disrupt operations and result in harm to our reputation and adversely impact our business and financial performance" under Part I, Item 1A "Risk Factors".

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: The Program includes a Security Response Team ("SRT") assigned the responsibility to ensure the Company responds to, communicates and effectively remediates, isolates and restores business operations during any security incident. The SRT procedures are derived from the National Institute of Standards and Technology (NIST) Computer Security and incident Handling framework.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee periodically reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our senior leadership for overseeing the company's cybersecurity risk management, including the Senior Vice President of Information Technology, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board of Directors and Audit Committee.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Using the policies and programs described above, Cass has implemented a multi-layered cybersecurity approach, including, deployment of advanced endpoint protection, threat intelligence, and anomaly detection tools, continuous monitoring of network traffic through intrusion detection and prevention systems, regular penetration testing and vulnerability assessments, and encryption of sensitive data at rest and in transit.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our cybersecurity program is led by our CISO, a seasoned leader in the cybersecurity field with over 25 years of extensive experience across cybersecurity, IT, risk management, and regulatory compliance. Holding both a master's in computer engineering and business administration, our CISO is also a Certified Information Systems Security Professional ("CISSP"). Reporting directly to our CIO, the CISO leads a dedicated team of information security and risk professionals. Together they are entrusted with the crucial task of managing our information security and data protection operations.

companyName: RALPH LAUREN CORP

ticker: RL


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in its role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually from the CTO. The audit committee of the Board (the "Audit Committee") specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit Committee receives an update on cybersecurity from the CTO on an as-needed basis.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: The Company's Director of Cybersecurity, assisted by the Company's IT department, is responsible for leading the team assessing, identifying and managing cybersecurity risks, including implementation of our cybersecurity risk management program and leading day-to-day cybersecurity operations. The Director of Cybersecurity has more than thirty years of experience overseeing and managing cybersecurity, cyber auditing, and IT operations within the U.S. federal defense, commercial and mining sectors and has extensive hands-on, practical experience navigating real-world cyber challenges. The Director of Cybersecurity holds both a bachelor's degree and master's degree in IT/Cyber, several certifications in the industry, including the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") credentials, Certified Information Systems Auditor ("CISA") certification, Certified in Risk and Information Systems Control ("CRISC") certification, Certified Data Privacy Solutions Engineer ("CDPSE") certification, and other IT technical, cloud, and cyber governance certifications.

companyName: SSR MINING INC.

ticker: SSRM


text: Blackstone's CTO, John Stecher is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as us, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions. Mr. Stecher received a BS in Computer Science from the University of Wisconsin – Madison and a MS in Computer Science from the University of Minnesota.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Our board of directors has approved and delegated initial cybersecurity threat responses to the Incident Response Team. The Information Security Officer and Chief Information Officer are assigned as the Incident Response Team leaders and reports summaries of key issues, including significant cybersecurity and/or privacy incidents to Incident Response Team which includes the Chief Executive Officer. If appropriate, the Chief Executive Officer will communicate actions taken the actions taken to our board of directors. Further, given the ultimate oversight of the Company's information security programs, the Chief Legal Counsel will communicate any regulatory compliance matters related to information system, including cybersecurity, to the board of directors.

companyName: CITY HOLDING CO

ticker: CHCO


text: Our S&RC chair previously served as the Chief Information Officer of a large healthcare company from 2011 to 2020 and as a Global Chief Information Officer at another company from 2004 to 2011. Other members of the S&RC have over forty years of executive and operational leadership experience at several global technology and telecommunications companies.

companyName: UNISYS CORP

ticker: UIS


text: The ISO has been established by the Service Center's Chief Information Officer, with dedicated cyber security staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering and management of cyber security policies, standards and regulatory compliance. Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation. We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls that comprises of five categories of defense – Identify, Protect, Detect, Respond and Recover. We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: The CISO manages Exelon's enterprise-wide cybersecurity programs and reports to Exelon's Chief Information Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Exelon since 2018 and was named to the current role in 2022. The CISO has 25 years of information technology and cybersecurity experience in the critical infrastructure sector, of which 23 years have been in the utility industry. The CISO leads CISS, which manages centralized information technology and operational technology security programs for the Registrants. The programs are aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and integrate cyber asset identification; threat assessment; risk assessment; risk management; and risk monitoring. CISS operates a security operations center for monitoring, identifying, and mitigating potential cybersecurity events or incidents.

companyName: EXELON CORP

ticker: EXC


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams. For a discussion of these risks, see Item 1A. Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor's cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.

companyName: Net Lease Office Properties

ticker: NLOP


text: The Audit Committee receives regular reports from our dedicated Chief Information Security Officer (CISO) on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

companyName: Seer, Inc.

ticker: SEER


text: Our information security function is led by our Head of Information Technology, and is supported by the Chief Financial Officer and Vice President of Legal and Business Develop (the Information Security Team). Our Information Security Team works with other members of our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, and utilizing third-party assessments to identify vulnerabilities.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk assessment to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: AFG continues to integrate assessing cybersecurity threat risks associated with its use of third-party service providers, generally at the initial engagement or renewal of the relationship. When conducting these assessments, AFG's Enterprise Information Security Group ("EISG") considers the risk profile of the vendor or supplier assesses security controls with the third parties and engages in contractual review to ensure appropriate security controls are in place.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Interim Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: The Company's processes for identifying, assessing, and managing material cybersecurity risks are incorporated into its overall Enterprise Risk Management process. The Company maintains a comprehensive cybersecurity risk management program, overseen by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), to support the security, confidentiality, integrity and availability of its critical information technology ("IT") systems and information.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: The Audit Committee of our Board of Directors provides oversight of our ERM program, of which cybersecurity is an integral component. Members of the Audit Committee receive updates on a quarterly basis, or more frequently as appropriate, from our CIO regarding existing and new cybersecurity risks, the effectiveness and continued maturity of our cybersecurity program, cybersecurity incidents (if any), and other relevant topics that help the committee provide effective oversight. In addition, the Board of Directors also receives an Information Security Services update on an annual basis from our Vice President of Information Security and our CIO. These updates cover a wide range of topics, including but not limited to, reviewing trends and program maturity, key metrics, current and emerging cybersecurity risks, and other cybersecurity developments.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: The management team ensures the implementation of robust monitoring protocols for preventing, detecting, mitigating, and remediating cybersecurity threats. We use a 'defense in layers' approach which constitutes a cybersecurity strategy that involves the use of multiple types of securities measures, each designed to protect against a different vector of attack. As noted above, management is supported by third-party monitoring, next-generation hardware, and automated logging analysis. We utilize third parties for penetration testing and log evaluation, which provides 24/7 network monitoring to assist in rapid identification and mitigation of any suspicious network access. We maintain an Incident Response Plan, based on guidance within the National Institute of Standards and Technology's Computer Security Incident Handling Guide, which provides an escalation policy for identified security incidents. Our escalation policy details specific escalation processes by which senior leadership (Senior Director of IT, Chief Financial Officer, and Chief Executive Officer) are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Our security steering team is responsible for assessing and maintaining our cybersecurity risk program, and engages third-party cybersecurity experts for risk assessment and system enhancements. In addition, we provide training to all employees both during the initial onboarding process and on an annual basis. We also conduct tabletop exercises to assess our cybersecurity readiness on an annual basis.

companyName: PRECIGEN, INC.

ticker: PGEN


text: We closely oversee risks associated with using third-party service providers. This involves evaluating their adherence to our security requirements, conducting technical assessments, monitoring their operational performance and establishing incident reporting protocols when our information is impacted by cyber incidents.

companyName: KENNAMETAL INC

ticker: KMT


text: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by IT Management. When we engage vendors and other third-party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: Oversight and Identification of Risks Associated with Third Parties Third Party Risk Management, a component of IT Risk Management, reviews new vendors prior to onboarding to oversee and identify potential risks and performs ongoing monitoring of emerging risks related to third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and risk reviews for financial, reputation, information security, cybersecurity, and business resiliency risk. These reviews are reported to the Information Technology Steering Committee (ITSC) for approval of new applications. The ITSC is chaired by the Chief Information Officer, who has more than 20 years' experience in IT management and cybersecurity, predominantly in the financial services industry. IT Risk Management performs contract reviews for security controls and notification processes. IT Risk Management also conducts annual IT risk assessments on critical and high risk applications.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: b The Board's Audit and Risk Committee is specifically tasked with overseeing cybersecurity and information technology risks, so that risk management strategies align with the company's overall risk profile.

companyName: IREN Ltd

ticker: IREN


text: The Company's cybersecurity program prioritizes vulnerability management, risk reduction, detection, and prevention to help protect against material risks from cybersecurity threats to its information systems. The Company routinely conducts internal and third-party cybersecurity risk assessments and penetration tests and incorporates relevant findings and recommendations into its overall cybersecurity strategy, as appropriate. Through these assessments, the Company develops targeted strategies intended to address the most significant cybersecurity risks and conducts at least one annual cybersecurity incident tabletop exercise to refine response plans.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: We maintain comprehensive cybersecurity and data privacy programs that are designed to be aligned to best practice frameworks and applicable laws and regulations, as well as our contractual obligations. These enterprise-wide programs are designed to secure our facilities, information systems and safeguard data throughout its lifecycle, including data provided to third parties performing services on our behalf. Our cybersecurity program incorporates standards, processes, and activities over a number of domains, including governance, access controls, facility and data protection, IT systems and data transmission security, threat intelligence and incident response, third-party risk management, disaster recovery and vulnerability management.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: We are externally managed by the Advisor, a subsidiary of Cohen & Steers. Representatives of the Company and the Advisor operate the Company's business through Cohen & Steers' information systems. Our business depends on the effectiveness of our and Cohen & Steers' information and cybersecurity policies and procedures to protect our and Cohen & Steers' network and telecommunications systems and the data that reside in or are transmitted through such systems.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation –Cybersecurity" included in Part I. Item 1 – Business of this report.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: conduct regular cybersecurity awareness training for all employees; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: NETLIST INC

ticker: NLST


text: The Company uses third-party service providers to perform a variety of functions throughout our business, such as enterprise resource planning, point of sale, eCommerce, wholesale sales, and web hosting. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Our vendor management program includes completion of a cybersecurity questionnaire for certain vendors designed to help us evaluate the potential cybersecurity risks associated with our use of the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: TerrAscend Corp.

ticker: TSNDF


text: We utilize a third-party cybersecurity operations center to provide 24/7 monitoring of our cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for assisting with incident response is in place to prepare support teams in the event of a significant incident. We also have an annual assessment, performed by a third-party, of our cyber risk management program against the NIST CSF. Cyber partners are a key part of EnLink's cybersecurity infrastructure. We partner with leading cybersecurity companies and organizations, leveraging third party technology and expertise. EnLink engages with these partners to monitor and maintain the performance and effectiveness of EnLink's technology environment.

companyName: EnLink Midstream, LLC


text: Our Associate Vice President of IT, who reports directly to the Chief Financial Officer and has over 10 years of experience managing information technology and cybersecurity matters and holds various EC-Council certifications including "Certified Chief Information Security Officer", "Certified Ethical Hacker" and "Computer Hacking Forensic Investigator", together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors", under the headings "A cybersecurity incident or failure in our information technology and storage systems or those of third parties upon whom we rely could significantly disrupt the operation of our business and adversely impact our financial condition" and "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: MoonLake Immunotherapeutics

ticker: MLTX


text: Anti-Malware Software. Our Computer Equipment is protected by anti-malware software. The management and administration of anti-malware software is restricted to a minimum number of authorized personnel as necessary.

companyName: Clene Inc.

ticker: CLNN


text: The Audit Committee The Audit Committee is responsible for overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, our information security strategy is periodically presented to the Audit Committee, which reports to the full Board of Directors. Regular meetings are held to report to the Audit Committee, which include a risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Risk Committee.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: A cybersecurity incident response plan that outlines a structured approach to investigating, containing, documenting, and mitigating cybersecurity incidents, including reporting findings and keeping senior management, the Audit Committee, and other key stakeholders informed and involved as appropriate; Annual external penetration testing to identify vulnerabilities, assess perimeter security, improve incident response, and strengthen security policies and procedures; Regular phishing, social engineering, and cybersecurity awareness training for employees with access to the Company's information technology environment;

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Sunrun Inc.

ticker: RUN


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: We could be adversely affected in the future by any information system or technology network failure or breach in data security, including any such failure or breach involving personally identifiable or other confidential information, any non-compliance with our contractual or other legal obligations regarding such information, or any violation of our privacy and security policies with respect to such information. See also Item 1A, Risk Factors, "Information systems and technology networks failures and breaches in data security, personally identifiable and other information, non-compliance with our contractual or other legal obligations regarding such information, or a violation of our privacy and security policies with respect to such information, could adversely affect us."

companyName: Crane NXT, Co.

ticker: CXT


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CISO has 27 years of cybersecurity experience, 17 of which are in the oil and gas industry. The Company's CISO is certified in strategic planning, policy and leadership, and is one of less than 400 CISOs globally that has graduated from the FBI's CISO Academy in Quantico, Virginia. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors.

companyName: CONTINENTAL RESOURCES, INC


text: The Board and our Chief Executive Officer is responsible for oversight of the Company's overall risk management program, including as to cybersecurity related risks, while management is responsible for the day-to-day risk management processes. The Board receives regular reports from our Chief Executive Officer, Chief Financial Officer and other members of management, regarding material cybersecurity threats and risks, effectiveness of our information security processes and status of ongoing cybersecurity initiatives and strategies. Our information technology (IT) team, which is overseen by our Vice President of IT, is responsible for the identification, assessment and management of cybersecurity risks we face and ensuring effective implementation of the Company's overall cybersecurity efforts. Our Vice President of IT has over 25 years of experience in IT systems, including cybersecurity risk management and incident response, and holds multiple industry-recognized certifications. Our Vice President of IT receives regular reports from the corporate IT Security Team, together with information provided by our third-party service organizations that monitor the Company's IT environment, regarding the Company's material cybersecurity threats and risks and the processes the Company has implemented to address them, which are reported to the Chief Financial Officer.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: Our management team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents. Our chief technology officer has over 40 years of experience and has held various leadership roles in information technology, including serving as a chief information officer and chief technology officer for the last 12 years. He has successfully implemented and managed large enterprise resource planning systems, e-commerce websites, stores and enterprise infrastructure, both cloud-based and on-premise. His expertise extends to evaluating and hiring cybersecurity personnel and outsourced managed services, defining incident response plans, conducting tabletop exercises, and establishing communication protocols with internal executives, board members, and vendors. He has firsthand experience in responding to actual cybersecurity incidents, showcasing a deep understanding of the challenges and complexities within the cybersecurity landscape in the retail sector. Our senior director of cybersecurity and compliance has a 15-year track record as an information technology and information security professional, complemented by an Executive MBA. His career is distinguished by a decade of leadership as the commander of the United States Army cyber protection team (174 CPT), where he gained cybersecurity experience at USCYBERCOM and ARCYBER. He holds multiple professional certifications, including CISSP, PMP and multiple SANS certifications. Our chief technology officer and senior director of cybersecurity and compliance report to the Audit Committee on these matters.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: The General Counsel and Chief Risk Officer ("CRO"), the SVP, Information Technology, the virtual Chief Information Security Officer ("vCISO") employed by DeepSeas Security, a cyber defense services business that partners with customers to reduce cybersecurity risks and the related costs. The vCISO and the CEO each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee at least once per year and more frequent as needed. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations or financial condition. Despite our continuing efforts, we may face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. For more information, see "Risk Factors – Risks Related to Information Technology and Cybersecurity" included in Part I, Item 1A of this Annual Report.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: Our CISO reviews and contributes to the cybersecurity risk reporting that is provided to the Audit Committee of our Board on a quarterly basis. The quarterly updates include cybersecurity risk assessment results, which include risks associated with the use of third-party service providers, and cover efforts to mitigate previously identified risks. Our CISO also oversees the incident response team and is responsible for updating our Board on any cybersecurity incidents, including the mitigation and remediation of these incidents, should they occur.

companyName: Toast, Inc.

ticker: TOST


text: Index to Financial Statements • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including incidents that could be indicators of attack against availability, integrity and confidentiality of information systems. • A third-party risk management process for service providers, suppliers, and vendors that includes examining their security postures and assessing their data and system protection controls.

companyName: Bloom Energy Corp

ticker: BE


text: The mission of our information security program is to design, implement, and maintain a comprehensive information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. Our information security program is comprised of internal and external security and technology professionals who work collaboratively to identify, assess, manage, and mitigate cybersecurity risks and threats across the Company and third-party contractors.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of these risks, see the section titled "Risk Factors – Risks Related to Our Business and Industry - If we or the third parties we rely on experience a compromise to the confidentiality, integrity or availability of systems, or data of our customers, shoppers, partners', or Instacart, we may experience adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations; reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences."

companyName: Maplebear Inc.

ticker: CART


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity incidents that have resulted in threat actors obtaining customer personal information, attempts to breach our systems, fraudulent activity and other incidents. As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. However, future threats could materially affect our business strategy, results of operations or financial condition. Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled "Risk Factors—Risks Related to Our Business—Cybersecurity incidents, or real or perceived errors, failures or bugs in our or our vendors' systems, or our website or app could impair our operations, compromise our confidential information or our customers' personal information, damage our reputation and brand, and harm our business, financial condition, operating results and prospects."

companyName: Root, Inc.

ticker: ROOT


text: In the last two fiscal years, the Company has not experienced any material cybersecurity incidents. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors - "Cybersecurity Breaches and other Disruptions to our Information Technology Systems", which is incorporated by reference into this Item 1C.

companyName: Marvion Inc.

ticker: MVNC


text: Engagement of Third Parties We regularly engage outside consultants and experts to assist us regarding our cybersecurity program. Engagements include an annual NIST Cybersecurity Framework assessment to ensure a reasonable cybersecurity program and retained leading external cybersecurity Incident Response (IR) experts. Blackbaud, Inc.

companyName: BLACKBAUD INC

ticker: BLKB


text: To date, we are not aware of any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Fluence. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on potential cybersecurity risks, please see Part I, Item 1A "Risk Factors" for the risk factor entitled "Our business depends on our ability to implement improvements to and properly maintain and protect the continuous operation and data integrity of our information technology infrastructure and other business systems and the inability to do so may have a material adverse effect on our reputation and harm our business prospects, financial conditions, and operating results."

companyName: Fluence Energy, Inc.

ticker: FLNC


text: The Company is subject to cyber-attacks and information theft risks in our operations, which we seek to manage through cyber and information security programs, training, and insurance coverage. To strengthen our security and cyber defenses, we maintain a defensive approach to cyber and information security designed to defend our systems against misuse, intrusions, and cyberattacks and to protect the data we collect. The Company's processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into the Company's overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. The Company's information security program maintains procedures and controls for the systems, applications, and data of the Company and of its third-party providers. The Company has an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others, and educate employees on mechanisms in place to report cyber-related incidents or suspicions of cybersecurity threats. Further, the Company maintains a cybersecurity incident response plan, which is managed by the Company's chief information security officer and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide self-service platform that allows the Company to track, manage and resolve information security risks across the organization.

companyName: CORPAY, INC.

ticker: CPAY


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Charlton Aria Acquisition Corp

ticker: CHAR


text: The Audit Committee of our Board of Directors oversees our policies and practices with respect to risk assessment and risk management, including the review, in coordination with our management, of our management of cybersecurity. The Audit Committee will receive regular updates from the Cybersecurity Committee on the state of cybersecurity risks we face. This will include briefings on any significant cyber incidents and ongoing risk management efforts. These updates will enable the Audit Committee to provide informed reports on cybersecurity matters to the full Board.

companyName: Ispire Technology Inc.

ticker: ISPR


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – Risks Related to Data Security, Privacy and Fraud," which are incorporated by reference into this Item 1C.

companyName: TheRealReal, Inc.

ticker: REAL


text: Within the last three years, Parker has only experienced immaterial information security breaches for which the total expenses were immaterial. As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors—Business and Operational Risks" of this Form 10-K, cybersecurity threats remain a risk to our business operations.

companyName: Parker-Hannifin Corp

ticker: PH


text: 8x8 prioritizes cybersecurity as a fundamental aspect of its operations and is dedicated to maintaining a robust cybersecurity program aligned with industry practices and regulatory standards. Through strong governance, risk management, and continuous improvement efforts, 8x8 aims to protect its systems, data, and stakeholders from cybersecurity risks.

companyName: 8X8 INC /DE/

ticker: EGHT


text: The Audit Committee of our Board of Directors is responsible for overseeing our risk assessment and risk management activities, including cybersecurity risks. The Audit Committee is briefed by our Chief Information Officer on cybersecurity risks at its regular meetings and separately as circumstances warrant. Cybersecurity risks are also included in our enterprise risk management program which is reported separately to the Audit Committee.

companyName: California Resources Corp

ticker: CRC


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and mitigations are also subject to oversight by the Security Committee of our Board of Directors. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We Could Be Harmed by Data Loss or Other Security Breaches," which should be read in conjunction with the information above.

companyName: AMAZON COM INC

ticker: AMZN


text: The cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, Brighthouse Financial utilizes a well-defined incident response plan that coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents, as applicable. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. Our Vice President of Information Technology and other members of his team oversee the implementation of this plan and are made aware of ongoing risks and incidents.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: As of December 31, 2023, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: In order to oversee and identify risks from cybersecurity threats and incidents associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.


text: Mr. Reszczenski works with senior management to implement and oversee processes for the regular monitoring of our information systems. If a cybersecurity incident involving the Company were to occur, Mr. Reszczenski would engage senior management to initially determine the potential materiality of the incident, the potential need for public disclosure, the timing and extent of the Company's response and whether any future vulnerabilities are expected. As part of this evaluation, senior management would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future cybersecurity incidents. After an initial evaluation by senior management, the relevant information regarding the cybersecurity incident and its materiality would be promptly reported to the Company's Board of Directors for further review and evaluation, including as to whether public disclosure would be required or advisable.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD