text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.

companyName: AmBase Corp

ticker: ABCP


text: Risk Management & Strategy The Company is in the process of maintaining a robust cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats, which encompasses these areas: risk assessment, incident detection and response, third-party risk, governance, board of directors' oversight, and management's role in managing cybersecurity risk.

companyName: America Great Health

secItem: Item 1C


text: The current CISO has over 20 years of experience in the field of cybersecurity and holds a Certified Information Security Systems Professional designation. The CISO has a staff of more than 100 employees dedicated to protecting the data and systems belonging to the Company, our customers, business partners and consumers.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Aptar has a detailed incident response plan that provides the process and workflow of communication for escalation of incidents to executive leadership to determine if there is a breach that would warrant further action. We also have a cyber incident materiality committee, which is a cross functional team that includes various departments across the Company including Finance, Public Relations, Accounting/Controller, Legal and the Director of Information Security. Our Information Security Department, in conjunction with the cyber incident materiality committee, review each incident under our materiality framework to assess whether further escalation and reporting is required and if the incidents could constitute a material breach. Periodically, our incident response team participates in a tabletop exercise or cybersecurity preparedness led by a third-party incident response provider.

companyName: APTARGROUP, INC.

ticker: ATR


text: Future Directions Looking ahead Urgently is dedicated to maintaining a vigilant stance against cyber threats. We will continue to invest in cutting-edge cybersecurity technologies, enhance our staff training programs, and foster collaborations with leading cybersecurity experts. Our board-driven, proactive approach to cybersecurity risk management is integral to our mission of delivering unparalleled value to our customers, employees, and shareholders, safeguarding our reputation, and ensuring the long-term success of our Company.

companyName: Urgent.ly Inc.

ticker: ULY


text: Our Cybersecurity Incident Response Plan ("IRP"), which generally aligns with NIST's guidance, provides management with a standardized framework for responding to an actual or potential cybersecurity threat or incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP also specifies the use of third-party experts for legal advice, consulting and incident response, as appropriate. The IRP undergoes at least annual tabletop exercises, the results of which are used to identify areas for improvement in our processes and technologies. We have protocols and processes by which certain cybersecurity incidents, as specified by our IRP, are escalated within the Company and, as appropriate, to the Audit Committee of the Board of Directors.

companyName: Xylem Inc.

ticker: XYL


text: Our cybersecurity and data protection strategy is part of our overall enterprise risk management program, and is focused on the identification, detection, management and mitigation of security risks and prompt incident response intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, technology and financial risk. Key elements of our cybersecurity risk management strategy include: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security program; • data protection policies and controls; and • the deployment of technologies designed to mitigate material cybersecurity risks to our critical systems, information, products and services, and our broader enterprise information technology environment.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Our technology platform and other information systems are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices. We are currently pursuing a SOC 2 Type 2 Report, and are working to achieve compliance with the National Institute of Standards and Technology ("NIST") 800-171 Cybersecurity Framework.

companyName: MediaAlpha, Inc.

ticker: MAX


text: The Company's information security program is designed with the goal of maintaining the safety and security of its systems and data. The risk management program is designed to identify, assess, and mitigate risks across various aspects of the company, including financial, operational, regulatory, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. With the departure of the Company's Chief Information Officer during the first half of 2023, the Company has engaged a third-party cybersecurity expert to assess the security of the Company's systems and networks. In addition, the Company engaged a third-party vendor, along with an in-house system administrator, together the "IT Management", to service the Company's information systems.

companyName: ATEL 14, LLC


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Governance.

companyName: TFF Pharmaceuticals, Inc.


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform simulations and drills at technical, management and executive levels.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Our CISO, in conjunction with other digital & technology leaders, implements and oversees processes for the regular monitoring of our information systems. This includes escalation protocols to identify, assess and escalate cyber incidents. We also deploy security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our CISO is equipped with a defined incident response plan. Our CISO meets quarterly with our risk management team and provides quarterly reports to the Audit Committee.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: To further enhance the Board and Audit Committee's role in overseeing cybersecurity risks, the Board formed a special working group that is comprised of two members of the Audit Committee to have more frequent and detailed dialogue with executive management (including our COO, CFO, CIO, CISO and VP of Internal Audit) on all areas pertaining to cybersecurity. This working group provides updates on a quarterly basis, or more frequently if necessary, to the Audit Committee. As a result of the steps taken by the Firm with respect to our cybersecurity program, we have not experienced a material breach to date.

companyName: KFORCE INC

ticker: KFRC


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: Rubber Leaf Inc

ticker: RLEA


text: The audit committee receives periodic reports from Mr. Gharib concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Audit Committee of the Board of Directors has oversight responsibility for risks to our company, including incidents related to cybersecurity threats.

companyName: Lifeloc Technologies, Inc

ticker: LCTC


text: Verizon effectuates cybersecurity management by providing for close cooperation among the CISO's team and other teams within the company, as well as by integrating cybersecurity risk into Verizon's overall enterprise risk management structures and processes. Each of our business units and certain functional groups have a Business Information Security Officer, who is an integral member of that unit or group, but reports to the CISO. This structure provides the CISO with line of sight across the enterprise. The CISO and members of her leadership team also meet regularly with business unit senior leaders, including the CEO, the Chief Financial Officer (CFO) and the Chief Human Resources Officer, to discuss business priorities, emerging threats and trends, and the performance of the cybersecurity program.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Role of the Qurate Retail Board of Directors The Qurate Retail board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, Qurate Retail's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of Qurate Retail's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: QVC INC

ticker: QVCD


text: The Company's cybersecurity program is overseen by the Risk Committee of the Board, which is responsible for ensuring the program is well resourced and able to protect the security and confidentiality of our data and that of our clients. The program is managed by the CISO who reports to the chief risk officer and is reviewed by regulators, as well as internal auditors. The CISO provides quarterly information security updates to the Risk Committee as well as the Company's executive-level Risk Council on cybersecurity programs, policies and controls; efforts to improve security; and responses to cybersecurity events. Annually, the CISO meets with the Risk Committee of the Board of Directors to communicate the Board's responsibilities for cybersecurity and privacy, as well as the cybersecurity program's strategy for addressing emerging risks and regulatory requirements.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Our management team, including the CEO, CFO, COO, Senior Director of Information Technology, Director of Information Technology, and Director of Accounting, as appropriate, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: The CIO and the CISO conducts regular meetings with the Audit Committee and the Board to communicate updates on cybersecurity risks, incidents, and mitigation efforts. The CISO and our security staff provides ongoing support to internal operations and oversight to our systems that offer services to our clients within our enterprise network. Our security staff is also augmented through an industry-recognized security operations center where systems are continuously monitored.

companyName: ICF International, Inc.

ticker: ICFI


text: To date, we have not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company or its business strategy, results of operations or financial position; however, we have faced and continue to face a number of cybersecurity risks in connection with our business. We continue to invest in the cybersecurity and resiliency of our IT systems and to work to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. "Risk Factors – Cybersecurity Risks."

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: Our information security program is led by our chief information security officer ("CISO"), who has over 25 years of experience in technology management, has 8 years of banking experience, and is a certified information systems security professional. The CISO oversees our "information security team" within our information technology department, which includes our identity and access management group, our security operations center group, and our security engineering and security architecture groups. These groups develop, deploy, monitor, and manage multiple processes, systems, and controls, including embedded controls within the technology we use, designed to help identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents. In addition to our information security team, we also employ an IT risk and compliance director who has over 18 years of IT governance, risk, and compliance experience and is responsible for the development, monitoring, and reporting of IT-related key risk indicators ("KRIs"), including KRIs related to cyber risks. Both our CISO and our IT risk and compliance director report to our chief information officer ("CIO"), who has more than 25 years of technology leadership experience, including leadership experience at global financial institutions, and is responsible, among other things, for oversight of our information technology environment, strategy, and security risks.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and annual employee training. Role or project specific employee training, as well as other training, may occur more frequently than annually, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer ("CTO"), who is assisted by our Chief Information Security Officer ("CISO"). Our CISO, CTO, and our Risk Steering Committee are informed about and oversee the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: ETSY INC

ticker: ETSY


text: The CISO reports security related incidents, findings, changes, etc. to the Risk Committee, on an annual basis or quarterly as needed. This information is communicated through the Company's Risk Department. The CISO has more than 25 years of experience in the information security field, including 23 years at WSFS, and holds several professional certifications and memberships in the Information Security, IT, and financial services fields.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: To date, management has not identified risks from cybersecurity incidents, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Roper, including its business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors, We rely on information and technology, including third-party cloud computing platforms, for many of our business operations which could fail and cause disruption to our business operations." above for more information. While we work to maintain our Cybersecurity Program, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: The Chief Legal and Compliance Officer (CLO), and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts. Together, our CLO and IT team have over 40 years of industry experience in implementing and managing information technology and information security systems, and members of our IT team maintain Certified Information Security Manager certifications. The CLO oversees the Company's cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, the risks and prevention of cybersecurity threats. Cybersecurity incidents are escalated based on defined incident severity criteria to management. As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board of Directors (Board).

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.

companyName: ROSS STORES, INC.

ticker: ROST


text: The ever-evolving landscape of cybersecurity threats introduces ongoing challenges. The Company recognizes the increasing frequency and sophistication of these threats. Despite implementing measures to secure operational and technology systems and fostering a culture of continuous improvement, the dynamic nature of cyber-attacks and vulnerabilities implies that these defenses may not be foolproof.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our security team is responsible for our overall information security strategy, including policy, security engineering, operations and cyber threat detection and response. Our security team has extensive experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes. Employees outside of our security team and third parties also have a role in our cybersecurity defenses. Such employees are given training which we believe improves our cybersecurity. We engage third parties to conduct risk assessments and evaluations of our security controls. Such risk assessment and evaluations identify, quantify, and categorize any cyber risks. In addition, we, along with third party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the assessment and evaluation process.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Blackstone has a process designed to assess, the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as us. This assessment is conducted on the basis of, among other factors, the types of services provided, and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: The Company has an established incident response plan for responding to cybersecurity incidents. The goal of the incident response plan is to detect and react to cybersecurity incidents, evaluate the scope and risk, respond appropriately, communicate effectively to all stakeholders, and ultimately reduce the likelihood of an incident recurrence. The Company's incident response team consists of seasoned information technology, legal and financial reporting Company personnel. The incident response plan, members of the incident response team and the steps to respond to a security incident are evaluated for appropriateness and effectiveness, and key personnel from cross-functional departments are involved.

companyName: ESSEX PORTFOLIO LP


text: Our CTO oversees our cybersecurity matters and reports to both the Audit Committee and the Board at least once a year, or more frequently as needed. The Audit Committee reviews and discusses with Company management key processes and risk indicators, progress on plans to address key risks, and any material changes in threat landscapes or risk posture which could negatively affect our business.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our senior management team, led by our Chief Financial Officer and Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;

companyName: BTCS Inc.

ticker: BTCS


text: The Audit Committee of our Board of Directors oversees our ERM program and is apprised of material risks arising from cybersecurity threats impacting our business. The COO provides quarterly reporting on our material enterprise risks to the Audit Committee. In addition to material risks identified by the ERM process, our information technology management provides periodic reporting, at least semi-annually, on our cybersecurity risk profile and risk mitigation strategies to the Audit Committee. This reporting is also made available to the full Board of Directors.

companyName: REGENXBIO Inc.

ticker: RGNX


text: The Technology Committee of our board of directors has primary responsibility for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity risks and incidents. The Technology Committee also reviews our cyber security risk profile on a quarterly basis. The Technology Committee, as well as the full board of directors, reviews and approves our information security and technology budgets and strategies annually. The Technology Committee provides a report of their activities to the full board of directors on a quarterly basis.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Other than the incidents that occurred prior to the Spin-Off, described in more detail in "Item 1A. Risk Factors—Failure to maintain the security of personally identifiable and proprietary information, non-compliance with our contractual obligations regarding such information or a violation of our privacy and security policies or processes with respect to such information could adversely affect us" as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operation, or financial condition. There is no guarantee that such risks will not evolve in the future and materially adversely affect the Company or that our processes to manage cybersecurity risks, including those described here, will operate effectively and as designed.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Primary responsibility for our cybersecurity program rests with our Vice President of Information Technology, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of work experience at the Company and elsewhere. The Vice President of Information Technology is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Financial Officer. The Vice President of Information Technology at times attends meetings of the Board to report on any material developments and risk management practices.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: The risk committee of our Board, chaired by a director with extensive cybersecurity expertise, receives quarterly updates from management on cybersecurity risks and incidents, including those with moderate or higher impacts. Management updates the full board regularly to ensure alignment on mitigation strategies. Our Chief Technology Officer, with more than 35 years of IT experience, leads our cybersecurity efforts, supported by a dedicated team of certified specialists and external consultants.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: We incorporate by reference the disclosure about cybersecurity regulation that is generally applicable to MDB from section Part I, Item 1, Business – Regulation – Data Protection ad Cybersecurity Regulation.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: External help may be engaged at any step in the process, before or after the materiality committee is invoked, depending on the complexity and reach of the incident. Though we do not have a retainer on any external third parties, we have identified a list of potential entities to engage when needed.

companyName: Satellogic Inc.

ticker: SATL


text: We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: We have measures in place to prevent, detect, and manage material risks from unauthorized access to our electronic information systems. These include various controls, technologies, and processes that protect confidential, proprietary, business and personal information that we collect, process, store, and transmit as part of our business operation.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: PARSONS CORP

ticker: PSN


text: Identification and remediation of information security risks and vulnerabilities in our information technology systems, including regular scanning of both internal and externally facing systems and annual third-party penetration testing; Implementation of security technologies intended to identify and assist in containing and remediating malware risks; Active monitoring of logs and events for our network perimeter and internal systems; Due diligence of information security maintained by third-party vendors that handle our data;

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board has been delegated specific risk oversight responsibilities related to cybersecurity and data protection. The Audit Committee receives regular updates from the CIO or CISO regarding the Company's cybersecurity defense and detection capabilities, incident response plans and associate training activities. Additionally, we have established the Avient Security and Privacy Council (ASPC), which is composed of the CISO, Chief Financial Officer, General Counsel, VP of Internal Audit, among other Avient leaders, and oversees the security-related governance, risk mitigation and regulatory compliance requirements of the Company globally.

companyName: AVIENT CORP

ticker: AVNT


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal IT environment.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: NeurAxis' Security Officer reports to NeurAxis' Chief Regulatory Officer and together, they lead the Company's overall cybersecurity function. The Security Officer has over 12 years of experience in managing and leading IT or cybersecurity teams and participates in various cyber security trainings frequently. The Security Officer collaborates with NeurAxis personnel and our outside IT vendors to identify and analyze cybersecurity risks to NeurAxis, considers industry trends, implement controls, as appropriate and feasible, to mitigate these risks and enables business leaders to make risk-based business decisions that impact cybersecurity considerations. The Security Officer meets with senior leadership to review and discuss NeurAxis' cybersecurity program, including emerging cyber risks, threats, and industry trends. The Security Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with external security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to strengthen our cybersecurity technologies and processes.

companyName: Neuraxis, INC

ticker: NRXS


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of the Company's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Cybersecurity Governance" below, the Board's oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with the Company's risk management function, the Company's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: The Company has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Company deploys a range of people, process and technical controls that are designed to protect the Company's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises; ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, and restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which the Company does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by the Company's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: BlackRock Finance, Inc.


text: Our Board of Directors oversees our risk management program, and because information security is a top priority and an important component of our day-to-day operations, cybersecurity is part of our overall approach to enterprise risk management. The scope of cybersecurity risk management encompasses all aspects of business operations, including supply chain risks and production manufacturing operations. Our cybersecurity practices are based on industry practices and frameworks such as those established by the International Organization for Standardization and the National Institute of Standards and Technology. We recognize the importance of the secure protection of our employee, customer, supplier and partner data and address material risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, security and availability of the information that we collect and store.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: We also have a cybersecurity resiliency strategy that will enhance our ability to anticipate, withstand and recover from cybersecurity attacks and maintain the availability of our critical business operations. Cybersecurity resiliency plans improve our recovery speed to protect Allstate and its customers against adverse impacts due to ransomware and other cybersecurity events.

companyName: ALLSTATE CORP

ticker: ALL


text: Our information security organization is led by our VP IT, who has over fifteen years of relevant experience, serving in various IT leadership roles within the medical device and medical technology industry. The VP IT is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, monitoring, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our VP IT reports to our CIO, who has over twenty years of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities. Our CIO reports to the Chief Financial Officer.

companyName: Embecta Corp.

ticker: EMBC


text: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes. The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board of directors on matters relating to cybersecurity risk management, as necessary.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example professional services firms (including legal counsel), cybersecurity management consultants, cybersecurity software providers, penetration testing firms, and forensic investigators. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management standard and underlying processes to manage cybersecurity risks associated with our use of these providers. The processes include risk assessments, security documentation reviews, and review of security questionnaires for certain vendors and security audits of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Sprinklr, Inc.

ticker: CXM


text: The Company maintains a cyber risk management program to prevent, detect and respond to information security threats. This program is supervised by a dedicated Chief Information Security Officer (CISO) whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CISO manages the program in collaboration with the Company's businesses and functions. To mitigate the risk of cybersecurity threats and data breaches we also have established policies and procedures, including a Cybersecurity & Data Breach Incident Response Policy and identified an Incident Response Team (IRT) with defined roles, responsibilities and means of communication. As part of our broader risk management and control framework we have implemented cybersecurity controls over the information technology and process control systems of the Company and of its third-party service providers. The Company engages third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer and vendor data as well as data affecting our process controls and data used to operate our manufacturing and converting facilities. We work with an independent assessor to conduct interim assessments and track ongoing efforts to continuously improve the Company's cyber risk management program. The most recent assessment was completed at the end of 2022. In addition, the Company utilizes an independent audit firm to perform specific attack and penetration reviews on an annual basis. While we have experienced threats to our data and systems, as of December 31, 2023, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: We use third-party service providers to perform a variety of functions throughout our business, such as distributors and supply chain resources and contract research organizations (CRO) and contract manufacturing organizations (CMO). We have certain vendor management processes to manage cybersecurity risks associated with our use of certain providers, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. These processes may include information security questionnaires, assessments, and imposition of contractual obligations relating to cybersecurity.

companyName: SCYNEXIS INC

ticker: SCYX


text: As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Rising Dragon Acquisition Corp.

ticker: RDAC


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors and our audit committee provide oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Risk Management and Strategy Managing Material Risks and Integrated Overall Risk Management Flywire has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our security and risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Flywire Corp

ticker: FLYW


text: Cybersecurity education is a priority for our associates and business partners. Associates complete cybersecurity training to help identify and respond to potential cybersecurity risks and reinforce safe behaviors. We also impose security requirements upon our third-party services and software providers, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident; however, we rely on such third parties to implement security programs commensurate with their risk, and their efforts may not be successful.


text: Both the Audit Committee and the ESG Committee report to the full Board regarding its activities, including those related to our cybersecurity risks and program. The full Board also receives briefings from management at least once a year on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics presented by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO").

companyName: NOVANTA INC

ticker: NOVT


text: The Bancorp also maintains a Third Party Risk Management Program to perform similar functions related to risks associated with the Bancorp's relationships with third parties. This assists the Bancorp in its management of its relationships with third parties, which includes considerations for identifying, analyzing and monitoring the cybersecurity risks that third parties may present to Fifth Third. The Bancorp also maintains a third-party incident response program to govern its response in the event of third-party cybersecurity events.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes has materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, operational results, and financial condition.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity threats, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Vital Energy, Inc.

ticker: VTLE


text: the availability, security of our property. Any disruption, compromise, or breach of our systems cybersecurity threat or incident could adversely our operations, customer service, product development, and competitive position. This could also result in a breach of our contractual to protect the privacy of our stakeholders. Such to affected parties, cybersecurity protection to our market share.

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: Our management team's experience includes a diverse background in telecom, technology, media and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Formula 1's Head of Information Security and Director of IT together have more than 30 years of experience and the Head of Information Security has multiple certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. All have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: Liberty Media Corp

ticker: FWONA


text: Our informational technology consultant leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our informational technology consultant has over 25 years of experience working with companies in the information technology field.

companyName: Gofba, Inc.


text: The CIO and CISO have primary responsibility over the Company's cybersecurity risk management program. Quarterly updates are provided to the Company's IT Council, which is comprised of executive, business unit, and IT leaders from across the organization, regarding IT initiatives and risk management processes.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: The Incident Response Team and the non-management employees who support the Incident Response Team identify, assess, respond to and coordinate both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation and regulatory and other government authorities as applicable and as required by law.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Cybersecurity risks are identified and documented by our cybersecurity team leadership, presented, and reviewed with the Fortrea Cybersecurity Risk Management Committee (the "Risk Committee") as noted in the Governance of Cybersecurity section below. The Risk Committee, in conjunction with business stakeholders as required, evaluates risks which are presented to them to determine materiality. Cybersecurity risks deemed material are then formally agreed upon as items to be reported by the Chief Information Security Officer ("CISO") to the Audit Committee.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Our program is embedded into Information Technology ("IT") and Information System ("IS") operations across the business with a focus on awareness, transparency, minimizing business impacts, and reducing enterprise risk, including strategic, compliance, legal and financial risk. The Company has policies and procedures in place to ensure compliance with its cybersecurity program and cybersecurity controls. Our program relies on a philosophy of continuous improvement by using periodic self-assessments, 3 rd party assessments, and customer/agency audits to determine cyber control presence, applicability, and effectiveness. Our program is customized with additional controls that address financial systems risk, nuclear quality assurance, Sarbanes Oxley, European Union cyber and data protection requirements, and supply chain risks.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: The Company has adopted processes and procedures for incident detection, containment and response, which are provided through a variety of resources, including: •24/7 Security Operations Center,

companyName: BELDEN INC.

ticker: BDC


text: We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: EchoStar CORP

ticker: SATS


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: a.risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: We have relationships with several third-party service providers to assist with cybersecurity containment and remediation efforts, including a forensic investigation firm, insurance providers and various law firms.

companyName: NEXTNAV INC.

ticker: NN


text: Cybersecurity is an important part of our risk management processes. The Company's Associate Vice President of IT & Facilities is responsible for overseeing the cybersecurity risk management program. He has over 20 years of IT management, cybersecurity, and information governance experience. In order to monitor and appropriately escalate cybersecurity risks, our Associate Vice President of IT & Facilities receives reports on a monthly basis, and more frequently as appropriate, from our third-party cybersecurity vendor.

companyName: Ocugen, Inc.

ticker: OCGN


text: The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team ("CSIRT") responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO's professional background, the CISO maintains several relevant industry credentials.

companyName: Strategic Education, Inc.

ticker: STRA


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. Refer to Item 1A – " Our internal computer systems, or those used by our contract research organizations or other contractors or consultants, may fail or suffer security breaches " and " We are dependent on information technology, systems, infrastructure and data," which are incorporated by reference into this Item 1C. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: We have implemented a risk-based cybersecurity program to identify, assess, prioritize and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity and availability of our information and operational technology systems and data stored on those systems. In general, we seek to address cybersecurity risks through a risk-based, cross-functional approach that is focused on preserving the confidentiality, security and availability of our information and information systems, and to mitigate and respond effectively to cybersecurity incidents and threats. As appropriate, the Company engages external parties, including consultants, legal counsel and audit firms to enhance its cybersecurity oversight and assist with incident response. Our cybersecurity program includes:

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Cybersecurity risks with long-term resolutions are evaluated and added to our risk register, which is reviewed and updated by a corporate committee quarterly. This corporate committee, consisting of senior executives and support staff, meets regularly to assess enterprise, including cybersecurity, and energy commodity risks. Our Chief Administrative Officer/CHRO manages our information technology department and has executive oversight of our cybersecurity program. Our Chief Information Officer and Chief Information Security Officer that report directly or indirectly to our Chief Administrative Officer/CHRO are responsible for implementation of our cybersecurity program. Our Chief Information Officer and Chief Information Security Officer have multiple cyber-related certifications from nationally recognized organizations and a combined experience in cybersecurity of 30 years.

companyName: Tri-State Generation & Transmission Association, Inc.


text: We use various means, including our Enterprise Risk Management ("ERM") process, in an effort to assess and manage cybersecurity risks that may be associated with our systems, operations, and third-party service providers. We also are working towards enhancing our cybersecurity risk management practices and various other security controls following the Spin-Off, and have at times conducted internal audits and engaged external assessors to help review our cybersecurity program and identify opportunities for maturing our program. For additional information, see "Item 1A—Risk Factors".

companyName: GRAIL, Inc.

ticker: GRAL


text: We employ a data privacy counsel to specifically improve our responses to growing international privacy laws. We believe that this enhances our data control and thus may reduce risk.

companyName: Altair Engineering Inc.


text: of the date of this annual report, this incident has not had a materially adverse impact on our results of operations and the matter was closed in 2024. Though our response has not included material changes to our cyber risk management, strategy, or governance, we have taken or plan to take additional cybersecurity measures to continue to advance our cybersecurity policies, practices, and technology.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: We rely on the cybersecurity strategy and policies implemented by Monroe Capital, the parent of both MC Advisors and MC Management that also apply to the Company. Monroe Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Monroe Capital's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Monroe Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Monroe Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: In addition to our own systems, we use third-party service providers to store, transmit and process information on our behalf. Third-party risk management is embedded in our cybersecurity risk management function. We leverage an independent cybersecurity assessment exchange service to gather information and provide real-time threat monitoring of our most critical third parties. We review relevant cybersecurity assessment reports and certifications from our third parties. Our standard contract terms also require third parties to maintain a standard level of security and controls.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Risk Management Strategy As a financial institution, cybersecurity presents significant risks. Accordingly, the protection of customer and business information is taken very seriously. Cybersecurity risk management is a component of the Company's formal Information Security Program. The Information Security Program is incorporated into the Company's Enterprise Risk Management Program, ensuring a holistic approach to risk prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Company's cybersecurity program is managed by its Chief Information Officer ("CIO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, protocols, framework, standards and processes. The CIO, who has extensive experience in overseeing and managing information technology and security programs, is kept appraised of potential cybersecurity incidents, including the prevention, detection, mitigation and remediation thereof, through the work of the Company's information technology team, which conducts and oversees ongoing security reviews of critical systems and continuous monitoring of event data. The CIO provides periodic reports to the Company's Board of Directors, as well as its Chief Executive Officer and Chief Financial Officer and other members of senior management as appropriate. These reports include updates on cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, ongoing compliance with applicable legal and regulatory frameworks and industry standards, assessments of the Company's information security program, and the emerging threat landscape. The Company's Board of Directors provides oversight of the Company's cybersecurity program and helps guide the Company's strategy for managing cybersecurity risks in the context of the Company's overall risk management system.

companyName: Penumbra Inc

ticker: PEN


text: Ongoing monitoring and evaluation of our cybersecurity posture and performance through regular vulnerability scans, simulated phishing tests, and penetration tests; Oversight of third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring;

companyName: FutureFuel Corp.

ticker: FF


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."

companyName: Monroe Capital Income Plus Corp


text: The majority of the directors who serve on the Compliance and Information Security Committee must be independent. The Committee meets quarterly and on an ad hoc basis.

companyName: ENVESTNET, INC.


text: As of the date of this report, the Company has not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or third parties on which it relies, will not experience a cybersecurity threat or incident in the future, and we continue to closely monitor cyber risk. We may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. Risk factors for a discussion of cybersecurity risks.

companyName: Designer Brands Inc.

ticker: DBI


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: P3 Health Partners Inc.

ticker: PIII


text: IT leadership provides a written report to the Board each quarter and the Global IT Director presents in person at least annually. Those reports and presentations include information on Innospec's cyber security and the related key performance indicators. IT leadership also provides external threat analysis to the Board when new relevant threats are identified as being exploitable and their potential impact on Innospec.

companyName: INNOSPEC INC.

ticker: IOSP


text: Part I Item 1A, 1B, and 1C Entergy Corporation, Utility operating companies, and System Energy In the event of a suspected or actual cybersecurity incident, the Security Incident Response Team (SIRT), which includes the CISO, has primary responsibility for initial identification and evaluation of potential business impacts and escalation of the incident's severity classification using pre-established criteria with a specified communication matrix and escalation thresholds. The Security Incident Commander, which role is served by rotating leaders in the CISO organization, provides tactical leadership and oversight management at the cross-functional level for the incident. The SIRT remains engaged throughout the incident response lifecycle, including detection and analysis, containment, eradication and recovery, and post-incident remediation, and coordinates with the impacted business functions, if warranted. Once a cyber incident is confirmed, the SIRT is responsible for maintaining situational awareness and continuous monitoring of the need for escalation or de-escalation of the incident's severity classification. As certain escalation thresholds are exceeded, additional levels of management notification are required by the SIRT, including notification of and recurring communication with Entergy's Incident Response Team, which includes the Chief Executive Officer, the Chief Operating Officer, the CSO, other executive management, and members of the affected business functions. Depending upon the facts, analysis, materiality, and anticipated or current impacts, the Chief Executive Officer and the General Counsel will determine the timing and cadence for communication of the cyber incident with the Board of Directors or Audit Committee.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: As part of the Company's risk management strategy, we require that all employees complete regular data security and privacy trainings, and conduct phishing tests and specialized training such as secure coding training for our developers. We also maintain a Security Ambassadors program, where employees act as an extension of the Security and Fraud Department to foster a security-focused culture.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Senior Vice President – Information Systems and Technology, who reports to our Chief Financial Officer. The IT Department's security team, a cross-functional group composed of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation and remediation of cybersecurity incidents and also for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Management consistently assesses, monitors and manages our cybersecurity practices to align with the evolving threat landscape. Our cybersecurity risk management efforts are designed to protect the Company's information systems from cybersecurity threats and to appropriately respond to any threats or incidents. Through ongoing communications, management and other applicable personnel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and the Board of Directors, as appropriate.

companyName: WillScot Holdings Corp

ticker: WSC


text: We also require all employees to perform annual cybersecurity training. We expect our employees to follow our company-wide policies and procedures relating to cybersecurity matters, which include policies related to IT security, remote access, multifactor authentication, use of the internet and social media, and handling of confidential information, among other items. Additionally, while we have insurance coverage in place designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: Regional Management Corp.

ticker: RM


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for advising on the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Annexon, Inc.

ticker: ANNX


text: To prepare to respond to incidents, the Enterprise Risk Management Committee periodically reviews and updates our cyber Incident Response Plan ("IRP"). The IRP provides a framework to address potential and actual cybersecurity incidents to include assessment to recovery by our Incident Response Team and notification to the appropriate management and board committees and regulatory agencies. The Incident Response Team is comprised of representatives from various departments including Information Security, Risk Management, Legal, Operations, Marketing and Accounting. Our Information Security Officer manages the Incident Response Plan and coordinates with senior level management and multiple areas of the company in execution of the plan. While we have experienced cybersecurity incidents, we have not, to our knowledge, experienced an incident materially affecting, or reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: Thred Up uses, stores and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: ThredUp Inc.

ticker: TDUP


text: Our Chief Information Officer (CIO) has over 20 years at Unisys with experience and knowledge of IT infrastructure, systems and operations. At Unisys, the CIO partners with our CISO and CPO on cybersecurity risk management matters.

companyName: UNISYS CORP

ticker: UIS


text: Media Group, Inc., recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Clubhouse Media Group, Inc.


text: In 2024 we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."

companyName: PARK OHIO INDUSTRIES INC/OH


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting enterprise software companies. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we have begun to establish a comprehensive approach to cybersecurity risk management and hold securing the data customers and other stakeholders entrust to us as one of our top priorities. As described in more detail below, we have established policies, standards, processes and practices for testing, training, and monitoring material risks from cybersecurity threats. We have devoted financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: VerifyMe, Inc.

ticker: VRME


text: Williams' new CIO joined the company in February 2025, and will succeed the company's retiring CIO, who is retiring in March 2025. The new CIO brings over 20 years of experience in information technology and leadership within the energy industry and has extensive expertise in digital transformation, cloud strategies, enterprise AI initiatives, and cybersecurity, as well as managing large-scale system implementations and integrations. He holds an Executive MBA from the University of Texas at San Antonio, a Master of Computer Science and Engineering from the University of Texas at Arlington, and a Bachelor of Information Science and Engineering from Bangalore University.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company's overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, our cyber risk management program activities and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company's cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.

companyName: TransUnion

ticker: TRU


text: As a foundation of this approach, we have implemented a layered governance structure, and our privacy and cybersecurity risk management systems encompass policies, practices, and procedures for incident responses, information security and vendor management. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business including European Union General Data Protection Regulation (GDPR), UK Data Protection Law, the Brazilian General Data Protection Law (LGPD), the California Privacy Rights Act (CPRA) and other US state privacy laws, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.

companyName: Shutterstock, Inc.

ticker: SSTK


text: has overall responsibility for risk oversight and cybersecurity risk matters. The Board is responsible for discussing with management the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs implemented by management to monitor and mitigate any exposures; and (iii) major legislative and regulatory developments that could materially impact the Company's data privacy and cybersecurity risk exposure.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: KINETA, INC./DE


text: A key function of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight responsibilities as a whole, as well as through our Audit Committee.

companyName: Samsara Inc.

ticker: IOT


text: perform annual system access audit with all departments and personnel review access logs on all perimeter, security and sensitive data areas We perform periodic internal assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Under the direction of the Chief Information Officer (CIO), who reports to the Company's Chief Executive Officer, and Chief Information Security Officer (CISO), who reports to the CIO, as well as certain other cybersecurity focused team members (the IT Security team), the IT Security team is responsible for addressing the dynamic threats against our electronic systems and assisting the workforce with handling system incidents, including by centralizing the reporting, detection and response to incidents to one functional team. The CIO and CISO have multiple decades of relevant IT experience. Incident management and response processes establish the recommended organization, actions and procedures needed to recognize and respond to an incident; assess the situation quickly and effectively; notify the appropriate individuals and organizations about the incident; organize the Company's response activities, including activating a command center; escalate the Company's response efforts based on the severity of the incident; and support the business recovery efforts being made in the aftermath of the incident. Additionally, third-party security experts are regularly engaged to monitor, assess, review and analyze the information technology landscape. The Company's incident response framework also defines the roles with respect to cybersecurity risk oversight and assigns responsibility to the IT Security Team. The IT Security team members have: (i) completed extensive cybersecurity training; (ii) have experience assessing cybersecurity incidents; (iii) actively participate in industry and government forums; and iv) collaborate with our peers to understand and improve cybersecurity intelligence, vulnerability management and defense strategies.

companyName: Endo International plc


text: Members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Audit Committee has oversight authority and receives reports regarding cybersecurity threat risks, as well as other cybersecurity related matters, on at least a quarterly basis.

companyName: Sabre Corp

ticker: SABR


text: Our management team, including historically our CTO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our former CTO who recently left the company had significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance, including over 10 years of experience managing enterprise level programs over IT. The Company has identified a candidate that it desires to fill the role.

companyName: BurgerFi International, Inc.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate an initial business combination. However, because we have investments in our trust account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: Catcha Investment Corp


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. The DDoS attack we experienced in late 2021 did have a material impact on our results of operations. We do face risks from similar attacks and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. Further, an attack on, or penetration of, our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risks. See "Risk Factors - Attacks on or breaches of our networks or systems, or those of third parties upon which we rely, could degrade our ability to conduct our business, compromise the integrity of our services and our communications platform, result in service degradation or outages, significant data losses, the theft of our intellectual property, investigations by government agencies and damage to our reputation, and could expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data."

companyName: Bandwidth Inc.

ticker: BAND


text: We engage various categories of third-party service providers to augment our efforts in monitoring, identifying, assessing, and mitigating significant cybersecurity risks. These third-party service providers encompass a range of expertise, including professional services firms such as legal counsel, cybersecurity consultants with specialized knowledge, providers of cybersecurity software solutions, managed cybersecurity service providers offering ongoing monitoring, protection and support, external testing firms specializing items like penetration testing to evaluate vulnerabilities, and forensic investigators who are enlisted as necessary to conduct comprehensive investigations and assessments when specific incidents or breaches occur.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: The Board of Directors oversees the risks to the Company from cybersecurity threats by periodically reviewing information technology security reports from management, including our Chief Information Security Officer ("CISO"), as well as reports from the Audit Committee of the Board of Directors. These reports also include, as applicable, an overview of any cybersecurity incidents. The Audit Committee provides assistance to the Board of Directors with respect to its oversight of the Company's technology security and data privacy programs. The Audit Committee is responsible for reviewing the Company's information technology security controls with the CISO and evaluating the adequacy of the Company's information technology security program, compliance, and controls with the CISO, which evaluation would include a consideration of any applicable cybersecurity incidents.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Our Chief Operating Officer and management team are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from the Head of IT Security and Compliance, the supporting internal team and support of third-party service providers.

companyName: Merus N.V.


text: Each of these committees provides summary reports on their activities, which is then communicated as appropriate to the Audit Committee.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: The Audit Committee is composed of members with diverse expertise including, risk management, technology, and finance. Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee has retained and consulted with Kroll to assist the Audit Committee in its cyber security oversight responsibilities. Because the method and sources of cyberattacks change frequently, Kroll provides invaluable, ongoing updates to inform and educate our Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices. Kroll typically attends and presents at two Board meetings each year.

companyName: Century Communities, Inc.

ticker: CCS


text: Our cybersecurity risk management program also includes processes and controls to assess the cybersecurity risk associated with third-party vendors and partners. Following an initial assessment of the level of enterprise risk potentially posed by use of the third-party, the vendor is then subject to further risk-based assessments, the level of which depends upon the assigned risk value of the service being provided, which may include the completion of security questionnaires and the provision of independent security certifications.

companyName: CENTENE CORP

ticker: CNC


text: Risk-based Controls for Information and Systems – We strive to secure our information technology infrastructure and data by implementing, maintaining and executing controls and continuously improving our cybersecurity program's maturity, risk management framework, policies, procedures and governance.

companyName: PVH CORP. /DE/

ticker: PVH


text: We maintain a comprehensive technology and cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality, integrity, and availability of our information assets. We regularly perform evaluations and testing of our security program, information technology infrastructure, information security management systems, and third-party service providers we use in our operations.

companyName: JBT MAREL Corp

ticker: JBTM


text: Cybersecurity is a foundational element of our operations. Our multi-layered approach — encompassing system security, vigilant monitoring, comprehensive training, and collaborative engagement — demonstrates our dedication to protecting our company, our clients, and the financial ecosystem. We remain steadfast in our commitment to maintaining the highest standards of cybersecurity resilience and response. We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and the Board on our response to a cybersecurity incident.

companyName: Paysign, Inc.

ticker: PAYS


text: As of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.

companyName: FORUM MARKETS Inc

ticker: FRMM


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. Hycroft's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: Employee Training and Awareness: We provide cybersecurity training to employees to raise awareness of the latest threats and best practices for protecting sensitive information. This includes training on how to recognize phishing attempts, handling secure data, and reporting security incidents.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: 5. Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the Board). The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We have a set of Company-wide policies and procedures concerning cybersecurity matters, which include numerous written information technology (IT) security policies, standards, procedures and guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: CINTAS CORP

ticker: CTAS


text: The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Risk Management Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, and risk reporting. The CISO and CRO also provide a monthly overview of the cybersecurity landscape to the Board of Directors.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC