text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: BioCorRx Inc.

ticker: BICX

secItem: Item 1C


text: As detailed elsewhere in this Annual Report, we rely on information technology to manage our business and support our operations, including our secure processing of proprietary and other types of information. Despite ongoing efforts, our systems for protecting against cybersecurity risks may not be sufficient, and a cyber attack or security breach could result in liability under data privacy laws, regulatory penalties, damage to our reputation or loss of confidence in us, or additional costs for remediation and modification or enhancement of our information systems to prevent future occurrences. As of the date of this report, we have not experienced any material cybersecurity incidents and are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. This does not guarantee that future attacks, incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. For additional information on cybersecurity risks we face, see "Risk Factors—Risks Related to Our Business and Operations—Cyber incidents or attacks targeting systems and infrastructure used by the oil and natural gas industry may adversely impact our operations, and a cyber incident or systems failure could result in information theft, data corruption and operational disruption and our results of operations, cash flows or financial position may be adversely impacted."

companyName: LandBridge Co LLC

ticker: LB


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives quarterly cybersecurity updates from members of management. These updates include topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks, if any.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, the Company has not detected any material cybersecurity incident to our own systems. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, or financial condition.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: • Oversight of the Bank's cybersecurity program is the responsibility of the IT Committee of the Board of Directors. This committee is also responsible for approving the program's budget and staffing. Management of the program is the responsibility of the Bank's information security officer. • To ensure appropriate segregation of duties, the information security officer is independent of IT operations staff and reports to the Bank's chief risk officer. The information security officer is responsible for responding to security events by ordering emergency actions to protect the institution and its customers from imminent loss of information; managing the negative effects on the confidentiality, integrity, availability, or value of information; and minimizing the disruption or degradation of critical services. • The IT Committee of the Board of Directors meets bi-monthly, or as needed, to review risks resulting from cybersecurity threats. • Testing is conducted annually using external third-party penetration testing and internal vulnerability assessments.

companyName: UNITED SECURITY BANCSHARES

ticker: UBFO


text: Commensurate with the risks we face and the sensitivity of the data and systems we are protecting, our Information Systems Security Program (ISSP) includes layers of administrative and technical safeguards designed to protect the confidentiality and integrity of sensitive information belonging to us and our employees, partners, and customers, to guard against the unauthorized access, alteration, disclosure, or destruction of that information, and to defend that information from potential, known, emerging, and evolving security risks. We have established multiple control points within our security infrastructure to reduce the risks associated with embedded technologies that could fail or be manipulated by nefarious actors, to prevent the intentional and unintentional infiltration of cybersecurity threats, and to maximize their separation from our sensitive information systems and assets. In developing our ISSP, our policies, standards, and procedures were heavily informed by and incorporated provisions from various sources of statutory and regulatory guidance as well as numerous leading industry frameworks, including the NIST Cybersecurity Framework, various NIST special publications, the Fair Information Practice Principles established by the Federal Privacy Council, the Privacy Management Framework developed by the American Institute of Certified Public Accountants, and the Center for Internet Security's Critical Security Controls.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: o Investment Decisions: The Board evaluates and approves significant investments in cybersecurity technologies, training, and talent based on the recommendations of management or our external vendors and consultants. o Regulatory Compliance: Management and the Board oversee compliance with relevant cybersecurity regulations and legal requirements.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: In July 2023, the SEC adopted a new rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, which requires registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For registrants, the final rules were effective September 5, 2023, with the new disclosures required beginning in annual reports for fiscal years ending on or after December 15, 2023. With respect to compliance with the incident disclosure requirements, all registrants other than smaller reporting companies must begin complying on December 18, 2023, with smaller reporting companies being given an additional 180 days, or June 15, 2024. The Company adopted these new cybersecurity disclosure requirements in the current fiscal year, as detailed below.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: We have implemented and maintain a cybersecurity risk management program, which consists of, among other things, comprehensive processes to identify, assess, manage, and mitigate material cybersecurity threats as part of our broader enterprise risk management program. We utilize an internal team of cybersecurity professionals and data privacy professionals to oversee this program. Where appropriate, we obtain input from external experts on our program, including with respect to prevailing cybersecurity practices and the latest cyber threat trends. Cybersecurity Team.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Oversight and Governance The Company's Board of Directors is charged with overseeing and approving Union's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Union's Information Security Officer (ISO) provides periodic updates regarding cybersecurity risks and the cybersecurity program to the Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Company's Board of Directors on a regular basis. Consistent with this responsibility the Board has delegated primary oversight responsibility over the risk management framework and oversight of the cybersecurity program, including oversight of cybersecurity risk and cybersecurity risk management to Union's IT Steering Committee.

companyName: UNION BANKSHARES INC

ticker: UNB


text: The VP of IT is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our VP of IT has over two decades of experience leading cybersecurity oversight. Others on our IT security team have cybersecurity experience or certifications that support these efforts. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least annually and have access to more frequent cybersecurity trainings through online trainings. We employ ongoing random testing of phishing and other cybersecurity threats across our entire employee base on a weekly basis with follow-up communication on results of these tests to members of management. Failures of these random tests require team re-training efforts.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: Members of our management team possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, information technology management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: Reporting to the Board The Chief Administrative Officer and General Counsel has primary responsibility to report to the President and Chief Executive Officer and to the Board and presents with the CIO where appropriate for the content of the presentation and/or to facilitate a substantive discussion.

companyName: YORK WATER CO

ticker: YORW


text: To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity risks and incidents, such as a breach of the Company's privacy or information security systems, or those of our vendors or other third parties, could compromise our information and expose us to liability, which would cause our business and reputation to suffer." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our CISO and CRO, respectively. Our CISO currently leads a team of cybersecurity professionals, has held leadership roles in the Cybersecurity team since joining us in 2019, and has over fifteen years of management experience within cybersecurity teams. Our CRO has held leadership roles in internal audit and risk for over a decade, including most recently as CRO of another public company.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ, that we believe are designed to prevent, detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the probability or risk of an incident. Risk management measures cannot provide absolute security, and may not be sufficient in all circumstances, or mitigate all potential risks.

companyName: Fisker Inc./DE


text: The CISO and CTO report to the Board of Directors who have ultimate responsibility in overseeing enterprise risks, including cybersecurity threats.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: We work proactively to prevent, detect, and minimize the impact of cybersecurity incidents through a structured incident response plan. This plan is tested and reviewed regularly with simulated incidents. We maintain business continuity, contingency, and recovery plans designed to maintain resilience during incidents. Lessons learned from past incidents are integrated into our governance, policies, and technology to strengthen our defenses.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: The audit committee receives periodic briefings from our Chief Financial Officer, the Chair of the IT Security Steering Committee, regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. Our audit committee provides periodic updates to the board of directors on such reports.

companyName: 89bio, Inc.


text: Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is a member of the Company's Corporate Operations group and reports to our Chief Information Officer, who reports to our Head of Operations, Technology and Products, who in turn reports to our Chief Operating Officer. Our CISO has cybersecurity experience spanning more than two decades. Prior experience includes senior security roles in large government agencies and Fortune 200 companies. He has spoken at area colleges and various industry events about information security. He holds a degree in electrical engineering, is a graduate of banking school, and maintains several industry certifications.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We design and assess our program based on the core principles of the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: Our cybersecurity team monitors prevention, detection, mitigation, and remediation of cybersecurity incidents through technical and operational measures, regularly reporting to the CISO. As a key member of the senior management team, the CISO provides updates to the Committee on the company's cybersecurity program, including risks, incidents, and mitigation strategies.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: To date, we have not experienced any material security incidents or data breaches as a result of a compromise of our information systems and are not aware of any cybersecurity incidents that have had a material impact or are reasonably likely to materially affect our business strategy, operating results, or financial condition.

companyName: Silk Road Medical Inc


text: In spite of the Company's investments in systems and processes to address cyber risk, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material effect on the Company. For further discussion, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Data and Fraud."

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see "System failure, information leakage and the cost of maintaining sufficient cybersecurity could adversely affect our business " in Item 1A — "Risk Factors."

companyName: WYNN RESORTS LTD

ticker: WYNN


text: The full Board also receives briefings from our CISO and CIO on cybersecurity matters twice annually. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.

companyName: FLEX LTD.

ticker: FLEX


text: As of December 2023, our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to CenterPoint Energy's cybersecurity and data privacy programs, including cybersecurity risk management. Prior to December 2023, our Governance, Environmental and Sustainability Committee, comprised of independent directors from our Board, oversaw cybersecurity responsibilities. As part of their risk oversight responsibilities, the applicable committee received quarterly reports from our Executive Vice President and General Counsel, or representatives from our cybersecurity or data privacy groups, and periodic reports from our third party consultants. Based on these reports, the applicable committee reported to the Board regarding certain cybersecurity or data privacy related items, including, among other items, CenterPoint Energy's progress in maturing its cybersecurity program, results of audits, penetration and vulnerability testing of CenterPoint Energy's cybersecurity program, the cybersecurity landscape and emerging threats, status of ongoing initiatives and strategies, incident reports and learnings from any cybersecurity events, compliance with regulatory requirements and industry standards, data privacy matters, and the cybersecurity budget.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: In conjunction with the operational day-to-day processes discussed above, material risks from cybersecurity threats are identified and assessed in connection with the Company's enterprise risk management process. Our Enterprise Risk Management Committee ("ERMC"), which is overseen by our SVP and General Counsel and is comprised of our senior leadership team and key functional personnel, meets quarterly to discuss the Company's enterprise risks, including cybersecurity risks. Cybersecurity risks are reviewed in detail and assigned risk ratings on an annual basis. The ERMC also discusses mitigation efforts, potential enhancements to processes and policies, and key risk indicators for the Company's risks, including cybersecurity risks. The ERMC's annual risk assessment is presented to the Board of Directors and the Audit Committee on an annual basis. In addition to the Company's annual ERMC risk assessment, our VP, Information Systems & Solutions and Director, Information Technology brief the Audit Committee on information technology and cybersecurity matters at least annually and provide interim updates to the Audit Committee on such matters on a quarterly basis.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: We conduct tabletop exercises related to Business Continuity Planning (BCP) and Disaster Recovery (DR), as well as Incident Response (IR) for our SOC/NOC Operations team

companyName: Rumble Inc.

ticker: RUM


text: Our CFO is responsible for approving budgets and our Senior Director of IT is responsible for preparing for cybersecurity incidents, approving cybersecurity processes, and conducting regular reviews of security assessments and other security-related reports.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: As discussed in more detail under the heading "Governance" below, as part of its general oversight duties, the Board oversees the Company's risk management, including the cyber security risks.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.

companyName: Outset Medical, Inc.

ticker: OM


text: As disclosed above, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. However, any failure in, or unauthorized access to, our information systems, as such term is defined in Item 106(a) of Regulation S-K, could disrupt our business, result in unintentional disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses, and have a material adverse effect on our business, financial condition, results of operations and prospects. Failures, interruptions, or data breaches involving our information systems, or the information systems of our vendors, could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations, and prospects.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Our Chief Information Officer and Corporate Director of Information Technology Security, in coordination with our Information Technology Department and other appropriate personnel, are responsible for assessing and managing our risks from cybersecurity threats. The Chief Information Officer has served in various roles in information technology and information security for over 25 years, has been in his current role for more than 10 years, and holds a degree in Computer Science. The Corporate Director of Information Technology Security has served in various roles in information technology and information security for over 30 years, has been in his current role for more than 15 years, and has been trained in multiple cybersecurity subjects.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: We have implemented an extensive cybersecurity program that leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats while maintaining the confidentiality and availability of our information systems. We have adopted physical, technological, and administrative controls on data security, and have a defined procedure for data incident detection, containment, response, and remediation. We perform periodic assessments to identify and assess cybersecurity risks, including through the utilization of third parties to assess our system vulnerabilities. We also regularly train employees on cybersecurity risks, including through monthly phishing simulations.

companyName: Amcor plc

ticker: AMCR


text: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards. We have conducted and plan to conduct evaluations of our cybersecurity program through periodic internal and external audits, penetration tests, and incident response simulations. We also require cybersecurity trainings when onboarding new employees and contractors/other workforce members, as well as annual cybersecurity awareness training for our employees and contractors/other workforce members. Our program is based on industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: As of March 11, 2025, the Company's business strategy, operations, or financial condition have not been materially affected by and are not likely to be materially affected by, any cybersecurity threats or incidents.

companyName: Summit Midstream Corp

ticker: SMC


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: PROKIDNEY CORP.

ticker: PROK


text: The Company has implemented controls based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and the Sarbanes-Oxley Act of 2002. Our Information Technology organization is led by the Chief Information Officer ("CIO") who is responsible for cybersecurity risk management. The Audit Committee of the Board of Directors is tasked with oversight of our overall enterprise risk management program, including cybersecurity, and receives recurring cybersecurity updates throughout the year with at least two cybersecurity reports to the full Board of Directors annually. Directors with experience in cybersecurity and technology play crucial oversight roles for our digital and cybersecurity strategies.

companyName: Ingersoll Rand Inc.

ticker: IR


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 18 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: SouthState Bank Corp

ticker: SSB


text: We have a management-level cybersecurity committee that has primary responsibility for our overall cybersecurity risk management program and oversees our internal cybersecurity personnel and retained external cybersecurity consultants and applicable third-party service providers. The cybersecurity committee includes our Chief Financial Officer, CIO, CLO and our Director of Internal Audit. Our CISO and members of the internal cybersecurity risk management team regularly meet with the cybersecurity committee to provide updates on cybersecurity threats, risk management activities and other issues related to preventing, detecting and mitigating cybersecurity incidents. Our cybersecurity committee also consults with internal and external cybersecurity and threat intelligence consultants and communicates with senior management about cybersecurity threats and resource needs for managing them.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Management's Role Managing Risk The CISO plays a pivotal role in informing the Compliance Committee on cybersecurity risks. The CISO, in concert with the Chief Compliance Officer and General Counsel, provides comprehensive briefings to the Compliance Committee on a regular basis. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: The Special Activities Committee of our Board of Directors has primary oversight responsibility for cybersecurity risks related to our products and services. The full Board of Directors also receives periodic briefings from management on the Company's product cybersecurity risks and programs. The Audit Committee also considers product and services cybersecurity risks in connection with its financial and compliance risk oversight role.

companyName: RTX Corp

ticker: RTX


text: The Board is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity and information technology risk management, risk assessment and major risk exposures. The audit committee receives periodic reports from the ITSC and our Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation.

companyName: ACELYRIN, Inc.


text: During the year ended December 31, 2024, we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: Palisades Venture Inc.


text: We have a vendor management process designed to manage cybersecurity risks associated with our use of third parties. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve varying methods of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and proprietary information. Our cybersecurity risk management program includes a multi-point cybersecurity incident response plan.

companyName: System1, Inc.

ticker: SST


text: Board of Directors' Role in Cybersecurity An integral part of Company's risk management oversight, which includes information security, is the role of the Board. This is reinforced by the independence and reporting structure of the Chief Risk Officer, who oversees the CISO and reports to the Board Risk Committee and administratively to the President and Chief Executive Officer.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: Loop Industries, Inc.

ticker: LOOP


text: We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.

companyName: Enertopia Corp.

ticker: ENRT


text: As noted above, we have a designated Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. With over 25 years of experience in the field of information technology and cybersecurity, our Chief Information Officer brings a wealth of expertise to his role and maintains both Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA) certifications and additional personnel on our information security team have cybersecurity experience and certifications. Our Chief Information Officer's background includes extensive experience as an enterprise chief information officer and is well-recognized within our industry. Our Chief Information Officer reviews with senior management, at least quarterly, the status of our Information Security Program, identified threats to our data security, and cyber incidents relevant to our operations and reviews these matters with our Board and/or Audit Committee at least annually, or more frequently when appropriate. Further, at least quarterly, our senior leadership team, including our Chief Financial Officer, General Counsel, Chief Information Officer, Executive Vice President of Financial Services, and Global Risk Management, prepares a comprehensive summary of certain key risks facing the Company (the "Risk Report"). The Risk Report includes feedback from multiple constituencies within the Company, incorporating and evaluating heightened risk areas identified by senior management, functional area teams within the organization, and management at the regional and local dealership levels. In addition to various enterprise-wide risks identified throughout this management-led process, the Risk Report highlights cybersecurity risks, tasking the Chief Information Officer or his designees with the responsibility to monitor such risks and, as appropriate, implement risk mitigation strategies. The Risk Report also clarifies that both the Board and the Audit Committee retain oversight of such risks. The Risk Report is shared and discussed at least quarterly with the Audit Committee and periodically with the full Board, with certain specified risks and mitigation efforts reported to the Board or designated standing committees on a more frequent basis, as appropriate.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and program. In addition, management updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents.

companyName: BM Technologies, Inc.


text: The Technology, Environmental, Safety and Security ("TESS") Committee of NCLH's Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.

companyName: NCL CORP Ltd.


text: Our Head of Information Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Head of Information Security has approximately 20 years of cybersecurity expertise, including more than 15 years working in information security with the U.S. Federal Reserve System, serving most recently as the Assistant Vice President for Operations and Information Security. He has received both a GIAC Security Leadership certificate and a Certified Information Systems Security Professional certification.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: Management's Role in Cybersecurity Risk Management A division of the Company known as Nucor Business Technology, or NBT, is responsible for the Company's information technology needs, including cybersecurity risk assessment and management. NBT's cybersecurity function is led by the Cybersecurity Director, who reports to the President of NBT, who in turn reports to the Company's Executive Vice President of Business Services and General Counsel and to the Chair, President, and Chief Executive Officer. The current Cybersecurity Director has more than twenty years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, and incident response.

companyName: NUCOR CORP

ticker: NUE


text: Furthermore, UNIFI management prepares, and the Audit Committee reviews and discusses, a quarterly assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated quarterly and is designed to bring to the Audit Committee's attention our most critical risks for evaluation, including cybersecurity risks.

companyName: UNIFI INC

ticker: UFI


text: systems necessary for the performance by our Manager of its duties under the Management Agreement. These IT systems include data hosting facilities and other hardware and software platforms, some of which are hosted by third-party service providers. Our Sponsor's IT systems, like those of most other companies, may be vulnerable to cybersecurity threats, including data breaches, cyberattacks, malware and computer viruses and interruption of services.

companyName: Belpointe PREP, LLC

ticker: OZ


text: Role of the Helios Board The ESG Committee addresses risks related to the global enterprise, including material risks facing the businesses, risks the Company may face in the future, measures that management has employed to address those risks and other information relating to how risk analysis is incorporated into the Company's corporate strategy and day-to-day business operations. As part of this oversight function, the ESG Committee is responsible for overseeing cybersecurity-related risks. The ESG Committee includes cybersecurity topics in its quarterly updates to the full Board, which provides further oversight over our cybersecurity-related risks and the Company's strategies to address such risks.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Further, cybersecurity risk is integrated into our enterprise risk management ("ERM") approach and is among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. We use several tools and controls designed to manage IT risk, including, but not limited to, controls for the management of privileged access, anti-malware tools, simulated email phishing attacks, and other email security tools intended to detect and prevent intrusions as well as monitor risks. All Cabot employees participate in monitored cyber security training and have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. We have a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engage in response planning, simulations, trainings, tabletop exercises, and other efforts to prepare for any incidents should they occur.

companyName: CABOT CORP

ticker: CBT


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption Or Breach In Security" in Item 1A. Risk Factors.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Risk is assessed based on multiple factors. First, our IT team updates and maintains our asset inventory to ensure all assets are included in our risk management process. From there, key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the stakeholders for action plans or sign-off on the acceptance of risk.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: We maintain a cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats, including by regularly assessing risks from cybersecurity threats and monitoring our information systems for potential vulnerabilities. Our cybersecurity program is designed to align with the National Institute of Standards and Technology Cybersecurity Framework.

companyName: RMR GROUP INC.

ticker: RMR


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C in their 2023 Form 10-K filed on February 16, 2024.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Pega Cloud Security Posture Pega Cloud undergoes several security assessments a year. Redacted versions of these reports are made available to our clients. Pega Cloud also maintains several security certifications, which are listed at http://pega.com/trust which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Training and Awareness - We provide security awareness training to our employees and contractors to help identify, mitigate, and report on cybersecurity threats. Our employees with network access must complete quarterly security awareness training which includes multiple interactive and video training modules with passing scores required to complete training compliance. We require annual PCI DSS and GDPR training as well as any other regulatory required security training. We also perform simulated phishing campaigns to further test security training effectiveness. We also periodically host tabletop exercises with IT and management to test and evaluate our incident response plan or playbooks.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Item 1A — Risk Factors — Risks Related to Our IT Systems and Cybersecurity."

companyName: BGC Group, Inc.

ticker: BGC


text: Oversight of cybersecurity risk is maintained by the Company's Board of Directors and is supported by the Audit Committee. The Audit Committee is primarily responsible for overseeing our design, execution and administration of the Company's enterprise risk management process, and with regard to cybersecurity risks, setting expectations and accountability for management and reviewing management's assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks and overseeing the Company's cybersecurity disclosures. The Company's information security program is managed by the Company's Chief Information Officer ( CIO), whom reports to the Chief Financial Officer (CFO), and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CIO periodically briefs the Audit Committee and our CFO, as well as our Chief Executive Officer (CEO), other members of the Board of Directors and other members of our senior management as appropriate. These reports include, but are not limited to, new developments, evolving standards, vulnerability assessments, third-party and independent reviews, threat environment summaries and technological trends. In the event of a potentially material cybersecurity incident, the CIO will meet with the Company's Audit Committee, CEO, CFO, legal counsel and any other members of senior management as appropriate to review the cybersecurity event, perform a materiality analysis and, if appropriate, identify any information required to be disclosed in a Current Report on Form 8-K.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "–Any major disruption or failure of our information technology systems or websites, or our failure to successfully implement upgrades and new technology effectively, could adversely affect our business and operations", "–Cybersecurity risks could adversely affect our business and disrupt our operations", "–Our business is subject to the risk of earthquakes, fire, power outages, floods, hurricanes, public health crises, ransomware and other cybersecurity attacks, labor disputes, and other catastrophic events, and to interruption by man-made problems such as terrorism and international geopolitical conflicts", "–We collect, store, process, and use personal data and other Member data, which subjects us to legal obligations and laws and regulations related to security and privacy, and any actual or perceived failure to meet those obligations could harm our business", under the heading "Risk Factors—Risks Related to Our Business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for the day-to-day assessment and management of risks from cybersecurity, including the prevention, mitigation, detection, and remediation of cybersecurity incidents, rests with an IT consultant who reports to management.

companyName: Pulmatrix, Inc.

ticker: PULM


text: In order to respond to the threat of security breaches and cyberattacks, we have developed and maintain a cybersecurity risk management program that is designed to protect and preserve the confidentiality, integrity and continued availability of our systems and information. Our cybersecurity risk management program also includes a cybersecurity incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incidents. The maturity of our cybersecurity program is assessed annually. We have developed an internal cybersecurity risk management framework which utilizes industry frameworks and standards, such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and other security standards, guidelines and best practices within our own framework to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: The SAC includes leadership across our security, enterprise risk management, internal audit, engineering, product, data ethics, legal, and commercial teams. The SAC is responsible for reviewing and approving major updates to LiveRamp's security policies and standards, reviewing and recommending actions related to exceptions to the security program, ensuring that the security program is in alignment with business objectives, ensuring that the organization has appropriate training and awareness related to security, and providing leadership and support for the security program.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: Our incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Privacy and Security Officer, Director of Information Technology, Chief of Operations and Development and other designated individuals. Our Privacy and Security Officer works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: NeuroPace Inc

ticker: NPCE


text: Our Information Technology (IT) department and IT Director, with the assistance of our legal department and CFO, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Our Audit Committee of our Board of Directors is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the Audit Committee of our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure.

companyName: Lifeloc Technologies, Inc

ticker: LCTC


text: Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyberthreats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Nu-Med Plus, Inc.

ticker: NUMD


text: Cybersecurity Program Components The Company's cybersecurity program includes a focus on governance, processes, technology, and people. Components of the program include the following: • Investments in security technology, such as vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring; • Regular monitoring and updating of the Company's IT infrastructure, to respond to the dynamic cybersecurity threat environment; • Use of internal resources and third parties to assess, test, validate, and strengthen the cybersecurity program, and the periodic use of third parties to perform penetration testing and to assess the quality and maturity of the program against the NIST Cybersecurity Framework; and • Assessing and managing cybersecurity risks associated with the Company's relationships with third parties, including technology and service providers, through due diligence efforts and the imposition of contractual obligations.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Our CIRT is supported by dedicated Information Technology ("IT") and Operational Technology ("OT") security resources, and further supported by various external parties, including but not limited to, cybersecurity service providers, assessors, consultants, auditors, and other third parties engaged on an as-needed basis.

companyName: Coterra Energy Inc.

ticker: CTRA


text: Identification and Assessment To identify and assess risk, we maintain a cybersecurity risk register which is reviewed regularly and updated as appropriate. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damages that could result from such risks (to the extent known), and the potential sufficiency of existing mitigating policies, procedures, systems, and safeguards. Risk is scored based on the potential impact to the business (inherent risk) and re-scored based on mitigations in place (residual risk). Following this assessment, we determine opportunities for further mitigating identified risks.

companyName: Life360, Inc.

ticker: LIF


text: Cybersecurity risks are overseen by the full Board of Directors and the Audit Committee as part of their regular oversight. Members of the Board and Audit Committee are encouraged to engage in ad hoc conversations with management on cybersecurity related updates to our risk management and strategy. Cybersecurity incidents are reported to the Chief Financial Officer to determine incident severity and response. In an effort to deter and detect cyber threats, we also provide all employees with access to digital assets with an ongoing cybersecurity awareness training program, which further educates employees and covers timely and relevant topics, including phishing, password protection, asset use and mobile security.

companyName: UPEXI, INC.

ticker: UPXI


text: Like many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our email, file storage or other business applications.

companyName: enVVeno Medical Corp

ticker: NVNO


text: We manage these known risks by using internal security controls incorporating principles from standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.

companyName: JUNIPER NETWORKS INC


text: As appropriate, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the company's incident response processes. The Information Security organization and Enterprise Risk Management are informed about and monitor the prevention, detection and mitigation of cybersecurity incidents through risk and control assessments, targeted reviews, scenario analysis, and monitoring of risk metrics. The company's performance in managing cybersecurity risk is reported to the Technology Risk Committee, the Enterprise Risk Committee and the Board of Directors.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats.

companyName: American Bitcoin Corp.

ticker: ABTC


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested Incident Management and Response program as well as business continuity and disaster recovery plans. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity evaluation, containment and remediation efforts.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: The SVP of Information Technology and the Information Security Manager have both worked in the Cybersecurity realm for many years. Both have led information security teams and have deep knowledge of the requirements for implementing and managing a cybersecurity program. Their expertise and experience include establishing policies and procedures, compliance enforcement, and the ability to identify potential security risks and develop strategies for mitigating those risks, incident response planning and threat mitigation.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: We engage third-party service providers in various capacities to strengthen our cybersecurity posture. The Company works with external consultants to conduct cybersecurity assessments, which may include evaluations of cloud security, network vulnerabilities and other areas of cyber risk. Our IT department, along with other key stakeholders, including Internal Audit, determines the need, scope and frequency of these assessments based on the Company's cybersecurity risk evaluation process.

companyName: Valaris Ltd

ticker: VAL


text: We apply similar processes, technologies, and controls to manage cybersecurity risks associated with third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party suppliers. We perform diligence on critical third-party suppliers that have access to our systems and data and to facilities that house critical third-party systems or data, and we monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require third-parties that we have identified as parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks based on accepted industry standards and/or to agree to be subject to cybersecurity audits conducted by our agents, which we conduct as we deem appropriate.

companyName: ETSY INC

ticker: ETSY


text: Our Board of Directors and senior management are actively involved in overseeing our cybersecurity policies and practices and managing those responsible for coordinating and implementing cybersecurity initiatives across the organization. Our Board of Directors receives updates from senior management on cybersecurity-related news events, developments in technology-related risks, threats and vulnerabilities that could pertain to the Company, and discusses with senior management updates to the Company's risk-management responses and strategies.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: As of the date of this Annual report on Form 10-K, we have not been materially impacted by any identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on such risks, see Item 1A, "Risk Factors - Business and Operational Risks - If we or our third-party service providers suffer a cybersecurity event, our reputation may be harmed, we may lose clients and we may incur significant liabilities, any of which would harm our business and results of operations."

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We have a robust cybersecurity training and awareness program that requires all employees to complete mandatory cybersecurity awareness, information handling, and privacy training at the time of onboarding and on an annual basis thereafter. In addition, we regularly test our employees compliance with best practices using various techniques, such as simulated phishing campaigns, to validate the efficacy of our cybersecurity training.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our President is responsible for assessing and managing our material risks from cybersecurity threats and conducts this assessment on a regular basis, or at least once per year.

companyName: GROOVE BOTANICALS INC.

ticker: GRVE


text: To date, the Company does not believe that cybersecurity incidents have materially affected the Company, its business strategy, results of operations, or financial condition. The Company cannot provide assurance that it will not be materially affected by any future material cybersecurity incidents. For more information about the cybersecurity risks the Company faces, see Item 1A, Risk Factors, above.

companyName: FutureFuel Corp.

ticker: FF


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our tenants, business partners, investors, and employees. Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Plymouth Industrial REIT, Inc.


text: We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy is aligned with the standards set forth by the International Organization for Standardization ("ISO") and the National Institute of Standards and Technology ("NIST"), and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees and contingent workers; • conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and • use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident. Where circumstances dictate the use of third-party service providers, such services include regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; evaluation and approval of our critical business partners and vendors; and participating in incident response processes. As part of our cybersecurity incident response policy, we identify, evaluate and mitigate any risks posed from engaging with any third-party service provider. In 2023 we did not experience any cybersecurity incident that materially affected or was reasonably likely to materially affect our operations, business, results of operations, cash flows or financial condition.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: To effectively prevent, detect and respond to cybersecurity threats, we maintain a cyber risk management program under the responsibility of the head of the Information Technology ("IT") function. Our IT head has more than 25 years of IT experience in the biopharmaceutical industry where she has been responsible for technology leadership and digital transformation across core operations. Management and administration of cybersecurity systems and activities are primarily outsourced to consultants who have cross-functional expertise in cyber security and who perform the work under the supervision of the IT head. Our IT head, in turn reports to the Senior Vice-President and General Counsel who is responsible for and knowledgeable of legal and contractual cybersecurity risk for the organization. The program is comprised of policies, standards, architecture, and processes, which are reviewed and updated on a periodic basis. The program leverages a multilayered approach of utilizing different practices, technologies, vendors or techniques without an overreliance on a single vendor. We engage with consultants to help develop and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements, and also evaluate and adopt cybersecurity software from reputable vendors in cybersecurity, some that provide software as a service solutions backed by a Security Operations Center. We also engage separate third parties to provide penetration testing, risk consulting, cybersecurity incident assessment and forensics, as necessary and in addition to IT's internal risk assessment processes. We work with many companies that provide hosted software or support for software systems. It is important for these companies to also have effective cybersecurity measures to protect data and systems. We have a self-attestation form to assess cybersecurity readiness that is sent to select vendors based on a risk assessment. For certain vendors, we request System and Organization Controls (SOC) reports or similar documents to provide assurance that the vendors have audited practices or practices in keeping with our legal requirements even if SOC audit documentation does not exist. We have also engaged legal counsel to advise on cybersecurity matters and we have developed an escalation protocol to report cybersecurity incidents as legally required. No material cybersecurity incidents have occurred to date.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: Our information security team is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. This team works cross-functionally throughout our organization to assess and prepare the Company for identification and mitigation of, and if necessary respond to, information security risks. The information security team is led by our Chief Information Officer, who has over 35 years of experience in various information technology roles, including 18 years at the Company serving in roles with increasing levels of responsibility. Our Vice President of Information Security and Technology, a Certified Information Systems Security Professional, with over 20 years of global experience in various information security roles, including 14 years of experience at the Company, is responsible for day-to-day management of information security team initiatives. The other members of the information security team have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).

companyName: Alkermes plc.

ticker: ALKS


text: We have established comprehensive processes to assess, identify, and manage material risks from cybersecurity threats. These processes include continuous evaluation of potential threats, regular security assessments of third-party service providers, and stringent monitoring procedures to mitigate risks related to data breaches and other security incidents. We periodically engage third-party consultants, legal advisors, and audit firms to evaluate and assess our risk management systems and to assist in the remediation of potential cybersecurity incidents, as necessary.

companyName: Outdoor Holding Co

ticker: POWW


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as ISO 27001. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive Incident Response Plan and Procedure that is reviewed on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests, threat intelligence feeds, and external audits by an independent third party. The Company maintains the ISO 27001 accreditation. We maintain a vendor onboarding program pursuant to which third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. The Company's assessment of risks associated with use of third-party providers is part of the Company's overall cybersecurity risk management program.

companyName: Inspired Entertainment, Inc.

ticker: INSE


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts; Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment; Recorded Future, one of the world's largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services and augment our incident response ability. Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our insurance policies and assesses whether we have appropriate coverage.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: The Company's policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks, considering controls from multiple security frameworks, such as the Center for Internet Security's Critical Security Control and the Payment Card Industry Data Security Standard. The Company, internally and through third parties, conducts multiple information risk assessments each year. Risks identified in such assessments are considered for inclusion in the Company's information risk portfolio and are then prioritized and addressed where appropriate through the Company's broader information security programs. Assessments along with risk-based analysis and judgment are used by the Company to determine what the Company believes to be the optimal way to manage these risks.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: Our program is informed by best practice approaches relevant to the technologies we use, the environments in which our services are designed and deployed, our business needs, and relevant regulatory requirements. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the various standards and frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Lemonade, Inc.

ticker: LMND


text: Our CIO has more than twenty-five years of experience advancing technology, digital transformation, and cybersecurity, including in the financial services industry. Prior to joining Urban One, he served as a Senior Vice President for Capital One Financial Corporation. During his tenure at Capital One, he supported the company's digital transformation and built the capabilities required to move its global enterprise to the cloud across technology divisions and platforms. Additionally, he has led strategic technology innovations and cybersecurity programs as an executive at several other leading Fortune 500 companies.

companyName: URBAN ONE, INC.

ticker: UONE


text: The Company is not aware of any cybersecurity threat or any material cybersecurity data breach to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: We deploy, configure, and maintain numerous technologies to enforce security policies, detect and protect against cybersecurity threats, and help safeguard the Company's information systems and assets. We operate a Security Operation Center ("SOC") to monitor cybersecurity threats, coordinate incident response resources, and reduce response times. Our internal SOC team is augmented by a third-party managed security services provider. The Company maintains a cybersecurity incident response plan that provides a structured approach for the Company's response to cybersecurity incidents. Under the plan, cybersecurity incidents are escalated based on a defined incident severity scale, including to the Board of Directors as appropriate. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises multiple times throughout the year. These exercises are conducted by internal team members and in some instances with assistance from third-party experts. The Company's cybersecurity program also includes regular cybersecurity trainings for staff. We actively evaluate the training effectiveness and adjust the trainings based on the evaluations.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We operate in the pharmaceutical industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect customers', employees', and vendors' information and prevent data loss and other security breaches, including a cybersecurity risk assessment program. Both management and the Board of Directors are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI


text: Our Head of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third-party audits. Our Head of Information Security and CDO have extensive experience assessing and managing cybersecurity programs and risks. Our Head of Information Security has served in that position since 2024 and, before eHealth, was the interim Chief Information Security Officer at Castlight Health where he led the company's overall security program. Before that, our Head of Information Security was Senior Manager of Cyber Security at Secureworks. His security experience also includes a 12-year career at Banc of America Securities and subsequently at Merrill Lynch on their information security teams as Senior Consultant, Systems Engineering & Architecture. Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company's product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr. Director and Head of Product, D3 Incubation Unit at Capital One. Our Head of Information Security reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate to do so under the circumstances.

companyName: eHealth, Inc.

ticker: EHTH


text: Our interim Chief Financial Officer periodically meets with our IT consultants and IT MSP about the Company's ongoing compliance and risk management and provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Third-party service provider risk is evaluated prior to and throughout the relationship. Third-party service providers must meet a minimum set of baseline security standards prior to being onboarded. During onboarding, the third party and the services they provide are added to the Information Security Risk Assessment, including consideration of inherent risk factors and mitigating controls. Alternative vendors and the effort to transition between vendors are identified during onboarding as well as in the event that the selected provider may fail in providing contracted services at any time. After a third party is onboarded, they are subject to the annual third -party risk management program, specific to their assigned risk criticality. This effort includes the review of service organization controls reports, business continuity and disaster recovery efforts, insurance certificates, and other compliance related concerns when applicable.

companyName: Investar Holding Corp

ticker: ISTR


text: We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how we may do so, see our risk factors under "Item 1A. Risk Factors ".

companyName: OS Therapies Inc

ticker: OSTX


text: Given the size of our company and the nature of our operations, we do not believe that we face significant cybersecurity risk.

companyName: BIOETHICS LTD

ticker: BOTH


text: We have established an incident response process designed to identify, assess, and respond to cybersecurity incidents. This process includes established roles, responsibilities and procedures to guide incident response operations, and reporting procedures for notifying members of management and the audit committee, where appropriate. We also maintain back-ups and disaster recovery plans designed to restore information in the event of a cybersecurity incident. We have not experienced any cybersecurity incidents, and are not aware of any threats, that have materially affected us or are reasonably likely to materially affect us, during the last fiscal year. However, like other companies in our industry, we and our third-party vendors may from time to time experienced threats and security incidents that could affect our information or systems. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in "Item 1A, Risk Factors."

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Our cybersecurity risk management processes are based on industry-recognized standards. We partner with leading cybersecurity companies to leverage third-party technology and expertise, and we engage with these partners to support monitoring and maintaining the performance and effectiveness of controls implemented in our environment.

companyName: GAP INC

ticker: GAP


text: The Fund is externally managed by the Advisers and has no employees or internal information systems. Thus, the Fund relies on the Advisers, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's chief compliance officer (the "CCO") oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The CCO and the Advisers also review key Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Fund to information technology vulnerabilities, and receive reports from the Fund's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Private Credit Fund


text: We implement tools to continuously monitor network traffic, system logs, and user activities to detect threats in real-time. Regular audits and metrics help identify gaps, track performance, and strengthen our cybersecurity posture.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: Our Audit Committee receives periodic reports from our CTO and management on our cybersecurity risks and the current threat landscape trends. In addition, management will update the Board directly, as necessary, regarding cybersecurity incidents. The full Board also receives presentations on cybersecurity topics from our CTO and other security management staff as part of the Board's continuing education on topics that impact the Company.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Our strategy for managing cybersecurity risk is integrated into the Company's overall risk management program and structure, as depicted in the Corporate Governance section of our Proxy under "Risk Oversight".

companyName: REGENCY CENTERS LP


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.

companyName: Outset Medical, Inc.

ticker: OM


text: At December 31, 2024, we have implemented thorough cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are often assessed as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors are required to complete annual cybersecurity awareness trainings, including specific topics related to browser safety, data protection, and email fraud. We have competent employees and consultants with a firm understanding of cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as notify management of such attacks in a timely manner.

companyName: International Stem Cell CORP

ticker: ISCO


text: These risk assessments include identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: The Nominating and Corporate Governance Committee of the Board bears primary responsibility for oversight of cybersecurity risks. The Nominating and Corporate Governance Committee is briefed on cybersecurity risks at least once each year and any material cybersecurity incidents by the Chief Information Officer ("CIO") and the Chief Legal Officer ("CLO"), as further described below. The Nominating and Corporate Governance Committee is composed of directors equipped with diverse skills needed to oversee the difference facets of cybersecurity risks effectively, including risk management, public company leadership, innovation and technology, corporate governance and finance.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our cybersecurity teams, in coordination with the CDC, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through the operation of our incident response plan and various other means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, as well as alerts and reports produced by security tools deployed in the IT environment. The CDC team oversees, identifies, and addresses security threats aimed at safeguarding PayPal employees, consumers, and merchants.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting annual re-assessments during their engagement.

companyName: Leatt Corp

ticker: LEAT


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: New York REIT Liquidating LLC


text: We engage third party security experts for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. We use the findings of these exercises to improve our practices, procedures, and technologies. We engage third party security experts to support our cybersecurity threat and incident response management and maintain cybersecurity risk insurance coverage.

companyName: TIDEWATER INC

ticker: TDW


text: For the fiscal year ending December 31, 2023, no cybersecurity threats were identified that significantly impacted or are expected to significantly impact our business strategy, financial performance, or financial position. However, despite the robust capabilities, processes, and security measures in place, there exists the possibility of undetected vulnerabilities or misjudged risks. While our preventive measures aim to mitigate cybersecurity incidents, absolute security cannot be guaranteed, necessitating ongoing vigilance and adaptability in addressing potential risks.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: The Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. It engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also maintains a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and its supply chain. The Company leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its risk management program.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: Onex Corp. employs a process designed to assess, typically prior to onboarding, the cybersecurity risks associated with the engagement of third-party vendors, including those of its externally managed companies such as us. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Onex Corp. may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Onex Corp. seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Onex Corp. also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.

companyName: Onex Direct Lending BDC Fund


text: The CSIRP provides that, when activated, the CSIRT will lead all aspects of incident response, including the engagement of outside counsel and other third-party resources, such as an external incident response team, forensic resources, a crisis management or public relations firm, or notification service providers. For incidents where the CSIRP is not activated, either the SIM Team or the Legal Team, depending on the circumstances, is expected to lead and manage the incident response.

companyName: FLOWERS FOODS INC

ticker: FLO


text: We have a well-defined cybersecurity incident response plan aimed at facilitating an effective response and handling of cybersecurity incidents. The incident response plan outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. We have also implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Knowles Corp

ticker: KN


text: We evaluate cyber threats such as data breaches, ransomware, and insider threats through threat modeling and business impact analysis. Prioritizing risks based on potential operational disruption ensures timely mitigation of critical threats.