text: Our cybersecurity risk management program is led by our global Chief Information Security Officer ("CISO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities through our information security office, which is responsible for the day-to-day identification, monitoring and management of cybersecurity risks. Our CISO reports directly to our global Chief Information Officer ("CIO"). Our CISO has significant experience in managing cybersecurity risks at major global companies in the pharmaceutical and defense industries. Our CISO regularly meets with the CIO to provide updates on cybersecurity matters. Our CIO updates our executive management on a regular basis to share cybersecurity related matters and discuss strategies to proactively manage cybersecurity threats. Our CISO and CIO brief our Audit Committee on our cybersecurity and risk management programs.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: We have dedicated cybersecurity resources led by our Chief Information Officer ("CIO"), who regularly provides reports to our executive officers, including the CEO and CFO. Our CIO has over 20 years of experience in the cybersecurity and IT fields and holds multiple degrees, including a Bachelor of Science in Information Science and a Master of Business Administration. Additionally, our CIO is a Certified Information Security Manager.

companyName: Brixmor Property Group Inc.

ticker: BRX

secItem: Item 1C


text: Threat and Vulnerability Management – Littelfuse uses an internationally recognized managed security services provider ("MSSP") and technologies to collect security alert and audit logs on a 24/7 basis, monitor and assess latest threat intelligence, provide analysis on new identified potential vulnerabilities, and provide response and support services to rapidly reduce any identified vulnerabilities.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Our cybersecurity risk management program aims to protect and preserve the confidentiality, integrity, and continued availability of our data and includes controls and procedures for the identification, containment, and remediation of cyber threats. Our cybersecurity risk management program includes, among other key features: regular cybersecurity risk assessments; detection and reporting of any cybersecurity events; periodic update processes for cybersecurity system exercises;

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: In addition, the CISO annually briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.

companyName: CONTINENTAL RESOURCES, INC


text: Based on an assessment using the previously described risk management processes, we do not believe that there are currently any known risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, cybersecurity threats may affect our business. See "Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results." in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program is led by our senior vice president of information technology who has over 20 years of experience in information technology development and capabilities. Our cybersecurity risk management program includes the following key components, which allows the management team to stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents: • implementing technologies to proactively monitor vulnerabilities and reduce risk, maintaining security policies and standards, and regularly updating our response planning and protocols; • maintaining business continuity, contingency and recovery plans, including a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • retaining a third-party cybersecurity provider for emergency incident response services; • annual assessments of our cybersecurity risk management program by a third-party security firm, as well as semi-annual vulnerability assessments and penetration testing by external service providers; • cybersecurity awareness training for employees as well as senior management, including quarterly refresher training; and • annual cybersecurity assessments of certain third-party service providers with access to our employee data.

companyName: HOST HOTELS & RESORTS L.P.


text: Using threat models and intelligence, we regularly assess a range of cyber threats, including hacking attempts, malware attacks, phishing schemes, infrastructure intrusions, and insider threats. In conjunction with our ongoing threat and vulnerability assessments, we evaluate the various ways, and the extent to which, cyberattacks may materially impact our business, including financial loss, regulatory penalties, reputation damage, and litigation risks. In this rapidly evolving cybersecurity environment, we recognize staying informed about emerging cybersecurity threats and industry best practices is an indispensable part of assessing and identifying cybersecurity risks, particularly within the manufacturing sector. Our involvement includes active participation in industry associations, sharing threat intelligence, and collaborating with regulatory bodies and law enforcement. This collaboration strengthens our defenses against potential threats to our financial and information systems.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our cybersecurity program is focused on protecting critical assets, including data, systems and applications; minimizing the impact of cyberattacks; understanding and preparing for the evolving threat landscape and complying with applicable law. The program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also continuously improving our cybersecurity program and maintaining a strong cybersecurity posture. Key to this approach is to broadly assess the potential impact of cybersecurity incidents on business operations and financial stability as well as any legal and regulatory requirements regarding cybersecurity. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks. • Incident Response and Recovery Planning: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including our vendors who handle our data and systems through due diligence and vendor assessments. • Education and Awareness: We provide regular, training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: FORWARD AIR CORP

ticker: FWRD


text: We require these suppliers to contractually agree to manage their cybersecurity risks according to our standards or to submit to cybersecurity audits conducted by our agents. regularly engage third-party experts to conduct information security testing, including penetration testing, on our systems and infrastructure.

companyName: Outdoor Holding Co

ticker: POWW


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We regularly conduct penetration and vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: We strive to protect the reputation of our Company by establishing, protecting and defending our data and information systems in a number of ways through a combination of processes, tools, and awareness-building. We aim to adhere to the best practices outlined in the National Institute of Standards and Technology and International Organization for Standardization frameworks, and our policies and procedures in managing personally identifiable information are in compliance with General Data Protection Regulation requirements.

companyName: Perella Weinberg Partners

ticker: PWP


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: STEP has adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident, including those that impact the Company, to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate, including stakeholders at the Company, as relevant. In general, STEP's incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all STEP personnel and STEP networks and systems, third-party systems and end-user devices, including those of the Advisor and those relied upon by the Company.

companyName: Stepstone Private Credit Fund LLC


text: The plan also provides the process and workflow of communication for escalation of incidents to executive leadership to determine incident classification, impact severity, and if and what further actions are warranted. Incident responses are overseen by leaders from our Software, Infrastructure Engineering, and Executive team.

companyName: SPAR Group, Inc.

ticker: SGRP


text: To ensure compliance with SEC requirements and maintain overall stakeholder confidence in the Company, all material and known facts regarding the cybersecurity breach will be recorded, including their nature, scope, and financial implications; and a Form 6-K will be prepared and filed within four (4) business days after the determination that a "material" cybersecurity incident has occurred. presently do not engage third parties to assist with evaluating the effectiveness of our risk-management and cybersecurity practices. The Company did not have any material cybersecurity breaches during the year ended September 30, 2024.

companyName: Kun Peng International Ltd.

ticker: KPEA


text: Key elements of our cybersecurity risk management program include: • overall risk assessment; • a technology team leveraging a third-party Security Operations Center (SOC) partner to monitor, manage and respond to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and regular phishing campaigns; • a cybersecurity incident response policy that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: CARGO Therapeutics, Inc.


text: Cybersecurity incidents continue to become more prevalent requiring adequate and continuous assessment, identification, and management of material risks associated with cybersecurity threats. These risks include, among other things, disruption of our business processes and proprietary software, and potential unwanted disclosure of protected personal information which may cause harm to our employees, and clients, violations of privacy laws and regulations, breach of confidentiality and other contractual obligations, litigation and legal action, and financial and reputational harm. We utilize cybersecurity technologies and established procedures and processes to identify, assess, and manage these material cybersecurity risks.

companyName: HireQuest, Inc.

ticker: HQI


text: Risk assessments and risk management plans are developed, communicated, and tracked. Annually, the CIO presents the Information Security Risk Assessment to the IT Steering Committee and to the Audit Committee of the Board of Directors for review and approval. Quarterly, the CIO provides an Information Security Risk Management Plan status report to the Audit Committee and an Information/Cybersecurity Status report to the full Board of Directors. Reports encompass internal information and cybersecurity assessments, business continuity plans, disaster recovery measures, incident response planning and testing, patch management and vendor management program statuses, as well as internal self-audit results. The information security risk assessment and updates on projects aimed at fortifying information security systems and emerging cybersecurity threat insights are communicated to the Audit Committee, maintaining transparency, and ensuring informed decision-making. Annual review and approval of information security-related policies by the Audit Committee underscore our commitment to governance and regulatory compliance.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: As of the date of this Form 10 - K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10 - K. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further action, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate to take. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: Reservoir Media, Inc.

ticker: RSVR


text: The Compliance and Quality of Care Committee of our board of directors has primary responsibility for oversight of our cybersecurity risk management program. Our CIO provides quarterly reports on our cybersecurity program to that committee and at least annually to our full board. The reports to the committee and the full board include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, quarterly NIST framework assessments, quarterly Company-wide phishing exercises and training, device encryption, routine resilience efforts including quarterly disaster recovery exercises, third-party vendor risk management, annual tabletop incident response exercise, annual business continuity exercise, cyber penetration tests, and 23 NIST cyber hygiene controls. Similarly, our chief compliance officer provides quarterly reports to the Compliance and Quality of Care Committee on patient privacy compliance efforts and related matters. The Compliance and Quality of Care Committee and the full board review, and the committee approves, the annual cybersecurity plan that sets out the primary initiatives and internal audits of the IT security function for the upcoming year. Historically, one or more board members have observed and participated in our annual tabletop incident response exercise.

companyName: Encompass Health Corp

ticker: EHC


text: As of the date of this Annual Report, we have not identified a material cyber incident that would have a material impact on our business, results of operations, or financial condition; however, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that we will not suffer a material cyber incident in the future. Refer to Part 1, Item 1A "Risk Factors" of this Annual Report for further discussion on cybersecurity risks.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: To ensure the effectiveness of our existing cybersecurity controls and processes, and identify areas for improvement based on the latest industry best practices, we regularly engage third-party consulting services to conduct independent audits and assessments. Additionally, we leverage external expertise to evaluate our cybersecurity and risk management strategy, review policies and procedures to address emerging risks, and maintain ongoing compliance with evolving legal and regulatory requirements.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: This team is responsible for assessing potential vulnerabilities and exposures to cybersecurity threats, implementing controls and measures designed to mitigate these risks, and regularly monitoring and updating these policies, to adapt to evolving threats. If an incident arises, the Head of IT notifies our Chief Legal and Compliance Officer, and Chief Financial Officer, who will raise issues to those charged with governance, as appropriate.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: The CIRP facilitates coordination across multiple parts of our organization and is evaluated by the Chief Risk Officer and legal department at least annually.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: BioAtla, Inc.

ticker: BCAB


text: Our CIO is tasked with ensuring that the highest levels of management and our Board of Directors are informed about the cybersecurity posture and potential risks facing the Company. Our CIO regularly briefs our CEO about cybersecurity risk management. The CIO's staff regularly informs the CIO about the latest developments in cybersecurity, including potential threats and risk management techniques. In the event of a cybersecurity incident, the CIO is informed promptly following its detection, and our response is governed by a detailed incident response plan that includes prompt actions to mitigate the impact of the incident and longer-term strategies for remediation and prevention of future incidents. The CIO has also chartered an Information Security Steering Committee made up of cross-functional executive leaders that meets quarterly on topics such as the current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.

companyName: Quanterix Corp

ticker: QTRX


text: Information systems" means electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: We place a high priority on securing confidential business information and the personal information we receive and store about our customers and employees. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, which we use, together with information collected from internal assessments, to develop policies for use of our information assets (for example, mobile phones and personal computers) and protection of personal information. We protect these information assets through techniques such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including restricting access to information based on business need. We utilize an established, nationally recognized cloud-services provider to maintain and manage our data with the exception of certain highly sensitive information, which we maintain in separate designated systems with enhanced security controls. In addition, we contract a third-party IT consultant with over twenty years of experience, who manages the core information technology functions of the business including coordinating with our cloud-services provider, implementing new processes, monitoring of our network for cyber threats, and other information technology administrative responsibilities. Throughout the year, we train our employees on cybersecurity awareness, confidential information protection and perform simulated phishing attacks. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have developed a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure and comply with applicable legal obligations. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. To date, we have not experienced a material cybersecurity or information security breach.

companyName: Heritage Global Inc.

ticker: HGBL


text: Blackstone's CSO reports to both our executive officers as well as our board of directors and/or our audit committee annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such annual reports, our board of directors and/or the audit committee receive periodic updates from Blackstone on the primary cybersecurity risks facing us and our Adviser and the measures we and our Adviser are taking to mitigate such risks, as well as on changes to our and our Adviser's cybersecurity risk profile or certain newly identified risks.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Oversee requirements of the Bank's Vendor Management Policy, including processes for approving third-party providers including the financial condition, business resilience, and IT security position of third-parties. Ensure risk assessments and New Vendor Relationship Information is completed for all vendor relationships. Review and approve risk assessments for significant, critical vendor relationships on an annual basis. Examine the Bank's Business Continuity and Disaster Recovery Plan, including updates and testing. Provide for comprehensive, effective, and, if required, independent audit coverage of IT risks and controls.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: We also provide regular, mandatory training for employees and contractors regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, including the detection and prevention of "phishing" and other attacks using social engineering, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: PubMatic, Inc.

ticker: PUBM


text: In the ordinary course of our business, we collect, store and transmit sensitive information including intellectual property, proprietary business information and personal information in connection with business operations. Additionally, we leverage our third-party vendors to collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Executive Vice President of Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: NOODLES & Co

ticker: NDLS


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including IT security leadership, the CFO, CEO, General Counsel ("GC") and third-party consultants as needed. IT security leadership, the CFO, CEO and GC work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: We utilize a range of internal and external resources to assess and identify cybersecurity threats and vulnerabilities. We access and utilize information drawn from a variety of publications, reports and services to assess our cybersecurity risk profile, develop awareness of emerging cybersecurity threats and threat actors and identify risk factors that are particularly relevant to the biotechnology and pharmaceutical sector and to our company. We also work with third parties that assist us to identify, assess and manage cybersecurity risks, including external auditors, consulting firms, managed security service providers and penetration testing firms.

companyName: OMEROS CORP

ticker: OMER


text: Our chief compliance officer, CTO, general counsel, and other members of management are part of an executive-level Security Steering Committee chaired by our CSO, along with subcommittees comprised of cross-functional representatives focused on evaluating ZoomInfo's data governance, cybersecurity incident response framework, security culture, and product and application security, among other areas. Members of the executive-level Security Steering Committee provide updates and analysis regarding cybersecurity, data privacy, and related security topics to the Board's Privacy, Security, and Technology Committee at each meeting. In addition, our legal, privacy, and compliance teams are focused on applicable cybersecurity laws and regulations and monitor changes to such laws and regulations with a view to implementing what we believe are best practices in the industry.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Our cybersecurity processes include: • Basic security awareness online training for personnel with company email, at least annually; • Phishing tests for personnel with company email on a periodic basis; • Reviews of certain third-party vendors' information security programs (as discussed below); • Consultation with external advisors regarding opportunities and enhancements to strengthen our practices and policies, on an ad hoc basis; • Electronic monitoring of the majority of our technology environments to identify cybersecurity events, including the use of a security information and event management system; • Periodic assessments of existing technology hardware configurations, patches, security and lifecycle; • Periodic assessments, in consultation with software providers, of existing software versions, configurations, patches and updates; and • Periodic assessments of data management and handling, including data use and access reviews. Certain information technology general controls are reviewed and tested as part of our internal control over financial reporting.

companyName: Cronos Group Inc.

ticker: CRON


text: The Information Security Program complies with all applicable regulations, including Section 501(b) of the Gramm–Leach–Bliley Act and Section 216 of the Fair and Accurate Credit Transactions Act of 2003. The Information Security Program aligns with National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security (benchmarks for device hardening.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: We have policies and procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including monitoring compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and related communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. In addition, a monitoring and detection system has been implemented to help identify cybersecurity threats and incidents. Our cybersecurity program also focuses on providing training and awareness to our employees and contractors on cybersecurity best practices.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: We continuously assess our risk of cyber threats to adapt quickly to the ever-changing challenges and risks surrounding cybersecurity. Atmos Energy has implemented policies, procedures, and controls to identify, protect, detect, and respond to cyberattacks or acts of online terrorism. Atmos Energy is also subject to the U.S. Department of Homeland Security Transportation Security Administration (TSA) security directive for our natural gas pipeline monitoring and control systems.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our corporate operations, business strategy, results of operations, or financial condition. As noted above, given our status as a REIT, we do not have actual or contractual access to the systems or information maintained by the property operators, managers and franchisors and we must rely on such operators', managers' and franchisors' programs and processes to protect the properties in which we invest.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, point-of-sale processing at our retail sites, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Our Vice President of IT and Digital, holds a Bachelor of Science in Computer Science and brings a wealth of experience from managing IT organizations in large, publicly traded companies, in addition to a distinguished background of service in the Israeli army, where she was responsible for managing classified information. Our CISO has an impressive 20-plus years in the field of cybersecurity, underpinned by a Bachelor's degree specializing in Knowledge and Information Management. Our CISO's extensive experience includes a period of 12 years during which he was employed by the Government of Israel, where he managed classified information systems and teams, a role that demands the highest levels of diligence and expertise in information security.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Our chief information security officer ("CISO") leads our global cybersecurity program and oversees the global cybersecurity services team, which is responsible for monitoring, identifying, assessing and managing cybersecurity threats across ADP. Our CISO reports to our chief security officer ("CSO"), who leads our global security organization and is responsible for cybersecurity, fraud prevention, operational risk management, client security management, and workforce protection. Our CSO has over 20 years of experience in a range of security roles, including serving as a chief security officer at another public company, and participates in various cyber security organizations. The current CISO has served in various roles in cybersecurity and information technology for over 25 years and has attained the professional certification of Certified Information Security Manager.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: The ISSB is comprised of the following: a. Chief Information Security Officer – Chair g. Chief Risk Officer k. Director, Audit The Chief Information Security Officer ("CISO") is responsible for the Company's enterprise-wide Information and Cybersecurity Program. Responsibilities include the Information and Cybersecurity program, Security Architecture, Application Security, IT Risk Management, Operational Security, Security Consulting, Awareness and Training, Policies and Standards development, Incident Response and Information Security defense / mitigation strategy, strategic planning, and Vendor and Service Provider monitoring. The CISO has 25 years of experience with Information Security Program development, Application Security program development, IT Risk Management program development, Incident Response preparation, planning, and testing, Operational and Technical Security Architecture, and Creating Zero-Day defense strategies. The CISO is a Certified Information Systems Security Professional, is a member of the Information Systems Security Association and Infragard, and participates in local and national Security consortiums. CISO demonstrates expertise in Graham-Leach-Bliley Act, Health Insurance Portability and Accountability Act, Payment Card Industry, International Organization for Standardization 27001, National Institute of Standards and Technology, Open Worldwide Application Security Project, and other programs to provide strategic consulting across a variety of industry sectors.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: As of March 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: PetroGas Co

ticker: PTCO


text: The Company conducts risk assessments and compliance audits, both internally and by independent third parties, for comparison against industry standards, including the National Institute of Standards and Technology cybersecurity framework and Federal Financial Institution Examination Council guidance. Risk assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receive reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board of Directors regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Directors regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: HP's work to defend against cybersecurity threats is occurring against the backdrop of an evolving global threat landscape. Like other Fortune 500 companies, we face a substantial number of cybersecurity threats—ranging from common cyberattacks such as phishing to more evolved threats that incorporate the use of AI. Our products and processes pose an attractive challenge for the most advanced of threat actors—including but not limited to those who are state-sponsored. As a global corporation with a wide range of systems and networks in place, and with customers who threat actors might also wish to target, we could face attacks not only on our own structures, but also on those of our many third-party providers and partners. In response to this threat environment, we have implemented a comprehensive cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our holistic approach is designed to integrate cybersecurity across the value chain, including in the design, development, and delivery of our products, services, solutions, and operations.

companyName: HP INC

ticker: HPQ


text: The Global Information Security Team has implemented processes to manage and report various security threats, including escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to our Cybersecurity Special Committee, Audit and Finance Committee ("AFC") and Board of Directors. We conduct cybersecurity incident simulations on a regular basis, including involvement of the Cybersecurity Special Committee, along with various tabletop exercises designed to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

companyName: COTY INC.

ticker: COTY


text: Board of Directors is ultimately responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company's cybersecurity, information security, and information technology risks. On an annual basis, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Financial Officer regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, which may include information regarding our exposure to privacy and cybersecurity risks deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: Prairie Operating Co.

ticker: PROP


text: The Chief Financial Officer is responsible, with the support of the Company's internal IT staff and external service providers, for helping to identify, assess and manage the Company's cybersecurity threats and risks, using internal resources as well as third-party service providers, by monitoring our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our risk profile, and subscribing to reports and services that identify cybersecurity threats.

companyName: Loop Industries, Inc.

ticker: LOOP


text: The Company's Chief Information Security Officer is principally responsible for day-to-day management of the Company's cybersecurity risk management program and reports to the Chief Technology Officer. The Chief Information Security Officer has more than 15 years of cybersecurity experience, including leadership roles at four publicly traded companies. He is a Certified Information Systems Security Professional, holds a M.S. in Security Technologies from the University of Minnesota and is an alumnus of the FBI Citizen's Academy. The Chief Technology Officer has served in various leadership roles in information technology and information security at the Company for over 14 years and holds a B.S. in computer science from Worcester Polytechnic Institute. The Chief Technology Officer reports directly to the Chief Executive Officer and works in coordination with the other members of the leadership team, which includes our General Counsel, Chief Operating Officer, and Chief Financial Officer. The Chief Technology Officer oversees a team of security professionals, which is led by the Chief Information Security Officer. The security team includes approximately 36 security professionals, 25 of whom are security engineers. Other members of the team oversee and manage identity, risk, compliance and audit functions.

companyName: Phreesia, Inc.

ticker: PHR


text: In the event of a cybersecurity incident, the incident response team is responsible for following the steps outlined in our incident response plan, including notifying our senior management, as appropriate.

companyName: W. P. Carey Inc.

ticker: WPC


text: As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect our systems and information may not successfully protect against all cyber incidents. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further action, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors–If we or our service providers do not maintain the security of information relating to our customers, employees and vendors and our music, security information breaches through cyber security attacks or otherwise could damage our reputation with customers, employees, vendors and artists, and we could incur substantial additional costs, become subject to litigation and our results of operations and financial condition could be adversely affected."

companyName: Reservoir Media, Inc.

ticker: RSVR


text: We have an established cross-functional IT incident response team, which includes our IT Director, to respond to cyber incidents effectively and to coordinate communications that may be necessary in the event of an incident. The incident response team has a prescriptive plan to track cyber incidents and responses and has established communication protocols when an event occurs, enabling better reporting of such events. Our incident response plan includes involving law enforcement, as needed, depending on the nature of the attack. Members of the IT incident response team and data breach team, discussed in more detail below, maintain relationships with key suppliers and other entities in order to collaborate and communicate about ongoing cyber threats that may impact the Company.

companyName: BOISE CASCADE Co

ticker: BCC


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Audit Committee. The Company has in the past, and may continue to do so in the future, engage third-party consultants, to review and assess the Company's information technology and security.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: By implementing these risk management strategies, the company aims to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding its assets and maintaining the trust of its stakeholders.

companyName: Arcellx, Inc.

ticker: ACLX


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our VP of Software Platform. This individual has over 20 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs in the healthcare and robotics industries.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: Our management team's experience includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together, this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: QVC Group, Inc.

ticker: QVCGA


text: These aforementioned companies utilize the latest industrial standards for security and data protection. Safeguards include continuous server monitoring, server and infrastructure security configuration consistently applied across all servers, firewall protection, anti-malware protection, a dedicated internal security team, applied Open Worldwide Application Security Project secure coding practices, and regular data backups.

companyName: Medicale Corp.

ticker: MCLE


text: The Board and AC regularly review the identification and management of enterprise cybersecurity risks and review regular reports from management on system vulnerabilities and security measures in effect to deter or mitigate breaches or hacking activities. The AC also reviews our guidelines and policies with respect to risk assessment and management of our major financial and information technology risk exposures, including enterprise cybersecurity, along with the monitoring and mitigation of identified exposures.

companyName: Aptiv PLC

ticker: APTV


text: We maintain high standards with respect to cybersecurity and our cybersecurity risk management program is integrated into our enterprise risk management framework, overseen by our Information Security Officer ("ISO"), meaning that cyber-risks are identified, evaluated, and managed with the same rigor as other strategic, operational, and financial risks. We have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles as a guide for our security controls and processes, helping us structure our activities around identifying potential threats, protecting systems, detecting incidents, responding to events, and recovering operations. We engage independent third-party cybersecurity auditors and testers annually to review our Information Security Management (ISMS) and renew our ISO/IEC 27001 certification. Key elements of our program include:

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Technology Officer ("CTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and CTO roles.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Our Board of Directors annually reviews the Company's Risk Management Statement, which defines key risk categories and associated metrics monitored quarterly by Management and reported to the Audit/Compliance/Risk ("ACR") Committee of the Board and the Board of Directors. Management regularly assesses inherent risk, mitigating controls, residual risk and emerging risk for each key risk category, inclusive of cybersecurity threats.

companyName: First Financial Northwest, Inc.


text: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, oversees the proper functioning of NTIC's cybersecurity risk management program. In particular, the Audit Committee, which is comprised entirely of independent directors, is responsible for reviewing and discussing guidelines and policies governing the process by which senior management of NTIC assesses and manages NTIC's exposure to risk and reviewing and discussing NTIC's major financial risk exposures, including cybersecurity risk, and the steps management has taken to monitor and control such exposures; it being understood that it is the job of management to assess and management NTIC's exposure to risk and that the Audit Committee's responsibility is to discuss guidelines and policies by which risk assessment and management are undertaken. The Audit Committee additionally receives periodic updates from senior management on NTIC's policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks and is responsible for reviewing the cybersecurity disclosures required to be included in NTIC's SEC filings.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Index to Financial Statements As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Legal, Human Resources and IT. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and company-wide communications.

companyName: IGM Biosciences, Inc.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall ERM Framework. As part of our ERM Framework, we maintain the traditional Three Lines Model (Management, Risk & Compliance and Internal Audit) to delineate accountabilities and establish a 'check and balance' management of risks. For additional information on our ERM Framework, refer to "Item 1. Business - Enterprise Risk Management."

companyName: Enstar Group LTD


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Partnership's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Partnership's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Partnership's digitalization, information and operational security policies help ensure strategic alignment of the Partnership's strategies with information security and risk management.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Remediation: When necessary, our cyber security consultants are prepared to respond as a CIRT (Computer Incident Response Team). If necessary, security experts are prepared to perform DFS (Digital Forensics Sciences) on devices that might have been compromised.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: Our CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO works with a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. This team manages and works to enhance the IT security structure with the goal of preventing significant cybersecurity incidents and increasing the resilience of our systems to minimize the business impact should an incident occur. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals on the information security team. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements, customer expectations, business priorities and emerging cybersecurity risks, and we expect to continue to make investments to maintain the security of our data and infrastructure. The underlying controls of the cyber risk management program are based on industry standards for cybersecurity and IT, including the National Institute of Standards and Technology ("NIST") frameworks and ISO 27001 requirements, although this does not mean that we meet all technical standards, specifications or requirements under NIST or ISO 27001 standards.

companyName: Qorvo, Inc.

ticker: QRVO


text: During the year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: LSEB Creative Corp.

ticker: LSEB


text: The Company has established a Management Technology Committee and a Board Technology Committee. These Committees provide oversight and governance of information technology and the Information Security Program and meet quarterly. The Board Technology Committee's responsibilities include: (1) monitoring the strategic deployment and usage of Information Technology throughout the Company using reports and presentations from management; (2) oversight of cybersecurity preparedness through information security reports, discussion of internal events and discussion of cybersecurity topics pertinent to the Company and the industry; (3) oversight of activities in support of the Company's business continuity/disaster recovery program to ensure optimal corporate resiliency in the unlikely event of a disaster; and (4) providing broad strategic guidance on the technology direction of the Company by, among other things, overseeing the development of the AmeriServ Strategic Technology Plan.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Safehold Inc.

ticker: SAFE


text: Respond and Manage. When detected, suspected cybersecurity threats are escalated to the Information Security Team (as described below) in various ways based on the nature of the cybersecurity incident, including but not limited to system engineer escalation, the Cars Commerce helpdesk and in-house and third-party security tools. Cars Commerce employees are also responsible for reporting any suspected cybersecurity or information security event that they observe or experience as soon as possible, by either contacting the Cars Commerce helpdesk, or the Information Security Team directly. The Information Security Team then creates a Security Incident Response Team ("SIRT") which, depending on the incident, is comprised of cybersecurity staff, Systems and Network Engineers, the Chief Technology Officer and the Chief Legal Officer, or other stakeholders as appropriate. The SIRT investigates and manages the impact of cybersecurity incidents in accordance with the security incident response procedures.

companyName: Cars.com Inc.

ticker: CARS


text: We maintain a management-level Enterprise Risk Committee, composed of our Chief Financial Officer, Chief Legal and Policy Officer and other members of senior management, which oversees the identification and management of corporate-level risks, including cybersecurity risk, using the COSO Enterprise Risk Management Framework. To support the identification of emerging risks and align our focus on our primary business risks, our Manager Enterprise Risk, whose job responsibilities are dedicated to enterprise risk management, surveys senior leaders at least annually to assess our most significant, or "Tier 1," enterprise risks. Based in part on this survey, our Enterprise Risk Committee assesses our most significant risks and considers the effectiveness of our risk mitigation efforts, and the Manager Enterprise Risk leads a presentation to our Board of Directors covering this information on an annual basis. Our Enterprise Risk Committee also oversees periodic follow-up assessments to analyze changes in existing, evolving and emerging risks and identify new or more effective measures for mitigation.

companyName: EQT Corp

ticker: EQT


text: We have not previously experienced a cybersecurity incident that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: As we are fully externally managed, we are reliant on our external manager's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our manager's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.

companyName: LUB LIQUIDATING TRUST


text: Our Board of Directors oversees risk management of our business and accomplishes this oversight primarily through the Audit Committee. Our Audit Committee discusses the Company's policies with respect to risk assessment and risk management, including guidelines and policies to govern the process by which the Company's exposure to risk is handled. As part of this process, our Audit Committee oversees our ERM program including risks related to privacy, data and information security, including cybersecurity. Management presents to the Audit Committee at least annually on our cybersecurity program and risks related thereto, and then the Audit Committee reports on that presentation to our Board of Directors. The presentations may address (1) the current cybersecurity landscape and emerging threats; (2) the status of ongoing cybersecurity initiatives and strategies; (3) incident reports and learnings from any cybersecurity incidents; and/or (4) compliance with regulatory requirements and industry standards. In addition, our executive team may report specific cybersecurity incidents to the Audit Committee or Board of Directors outside of a regularly scheduled meeting based on the impact of the incident. Our internal escalation process is set forth in our incident response plan.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: Incident materiality The Commerce Bank Cybersecurity Incident Investigation and Response Plan is a component of the Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response plan includes timely notification of a material cybersecurity incident to the Board of Directors and other members of senior management.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: We are working with our information technology consultant to help improve our overall cybersecurity and plan to take any necessary steps to protect our information assets and operations from internal and external cyber threats in the event any such steps are recommended.

companyName: Gofba, Inc.


text: In addition, we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: Balance Labs, Inc.

ticker: BLNC


text: Leveraging the Company's Cybersecurity Risk Management & Governance process, it has identified cybersecurity risk factors that are inherent to the Company's business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which the Company is exposed. Additionally, mitigation of these risk factors is tracked by management as part of the Cybersecurity Maturity Roadmap.

companyName: Drilling Tools International Corp

ticker: DTI


text: As part of our strategy, we also leverage reputable third-party service providers to implement and maintain processes and controls to manage identified risks. We perform rigorous due diligence before onboarding and engage in ongoing monitoring of all third parties with access to our information assets to ensure such parties maintain adequate security controls. Our security practices also include continuous threat monitoring and detection services as well as vulnerability and patch management process to ensure systems are hardened to further protect our critical information assets.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties. Members of our Management Leadership Team also report to the Board more frequently than annually on data protection and current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity threats. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information Systems and Technology, and industry certifications awarded by the International Information System Security Certification Consortium (ISC2); Certified Information Systems Security Professional (CISSP), and Information Systems Security Engineering Professional (ISSEP). We also have a U.S. Data Privacy Officer, who reports to our Chief Legal Officer, and a European Data Privacy Officer, who reports to our CISO, each of whom have primary oversight of material risks related to data privacy in their respective territories. Our U.S. Data Privacy Officer, who is a licensed attorney, holds industry certifications awarded by the International Association of Privacy Professionals (IAPP). Our European Data Privacy Officer has a master's degree in public international law and over 10 years of experience working in cybersecurity, data protection and governance.

companyName: Wheels Up Experience Inc.

ticker: UP


text: We are continuously focused on ensuring our Company is protected from potential cyber threats. Our Information Technology (IT) team is comprised of employees with a diverse mix of skills, backgrounds, perspectives, and relevant expertise, that undergo extensive training as part of their employment with the Company. We believe these measures together with our cyber risk management program as well as our policies, processes and procedures set a high benchmark for our employees to address and respond to cybersecurity threats.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: We have also established a formal third party risk management (TPRM) policy which defines the criteria that a third party service provider must meet in order to be considered by us. All vendors are risk ranked and reviewed by our TPRM team with results reported to our information security committee, which ultimately approves the use of new and existing vendors. In addition, we maintain an internal information security committee comprised of cross-departmental company executives and IT leaders to ensure that we maintain strong governance mechanisms and to ensure compliance with our security policies and procedures. During the year ended December 31, 2023, we did not experience any material cybersecurity incidents.

companyName: Essent Group Ltd.

ticker: ESNT


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, including systems provided by third party service providers, we utilize a regularly updated incident response plan that was developed taking into account a recognized third-party cybersecurity framework. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel. The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident. The CISO or another member of the incident response team also reports to the Company's Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions. The Disclosure Committee also consults with the chair of the Audit Committee of the board of trustees in making determinations regarding applicable SEC reporting requirements.

companyName: American Homes 4 Rent

ticker: AMH


text: Our Board oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks to our business. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: NET Power Inc.

ticker: NPWR


text: The Board, in coordination with the Audit Committee, oversees the Company's management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: BRC Inc.

ticker: BRCC


text: Executive Officer and Chief Financial Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Our board of directors, in coordination with our audit committee, oversees our management of cybersecurity risk, with the audit committee reviewing and discussing with management matters related to our Cybersecurity Program, including as it relates to financial reporting. The board of directors and audit committee receive periodic reports about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into the Company's enterprise risk management assessment and reported to our Board as needed. We also share the key results of third-party assessments with our board of directors and audit committee.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Our IT Steering Committee, comprised of our Chief Executive Officer, our Chief Financial Officer, and our General Counsel, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over our third-party IT consultants, monitoring systems and employee engagement. Our senior management team is responsible for reporting any identified cybersecurity risks to the Audit Committee of our Board of Directors.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: Our cybersecurity risks and associated mitigations are evaluated by our IT team, including our VP of Technology Operations and Information Security, as part of our enterprise risk assessments that are reviewed by our management team. Our VP of Technology Operations and Information Security serves as the Company's designated Chief Information Security Officer and is responsible for developing and implementing the cybersecurity risk management program, including reporting on cybersecurity matters to the Board of Directors. The VP of Technology Operations and Information Security has more than 19 years of experience leading cybersecurity oversight.

companyName: Intellicheck, Inc.

ticker: IDN


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.

companyName: Southern States Bancshares, Inc.


text: The Company invests in information technology systems for its Herbo website. Such investments, including the implementation of technology updates, improves the Company's customers' experience, and supports both compliance and internal controls. The Company is actively attempting to identify and manage cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is a Company Priority.

companyName: ECO SCIENCE SOLUTIONS, INC.

ticker: ESSI


text: On at least an annual basis, a cyber risk report that highlights program governance, risks, and opportunities is provided to the Audit Committee and the full Board.

companyName: Dorman Products, Inc.

ticker: DORM


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold quarterly online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Board Oversight of Cybersecurity Matters Assessing and managing information security matters is the responsibility of our Board of Directors. The Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board meets with the senior executives, specifically the Chief Executive Officer, and Chief Financial Officer on at least an annual basis to discuss cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities. The Audit Committee receives regular reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves the Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the information security program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging risk or material issue.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Our VP of Information Technology, and our management committee on cybersecurity, which includes our audit committee, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The VP of Information Technology has twenty years of experience in IT on-premise and cloud infrastructure, enterprise applications, and operations across large and mid-size life science companies with a focus on IT controls for compliance and security.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Somayajulu (Soma) Bulusu, Executive Vice President of Technology: Mr. Bulusu joined the Company as EVP of Technology in February 2024. Mr. Bulusu has over 25 years of experience in engineering, product, and service delivery. Mr. Bulusu joined the Company from Chewy, Inc., where he led the Information Technology and Engineering teams. His previous roles include leadership positions at Amazon, Nuance, and TouchCommerce.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Cybersecurity is integrated into our overall risk management systems, including our annual enterprise risk management, internal controls, business continuity and crisis management, third-party risk management, insurance risk management, and employee compliance processes. Our Cyber Incident Response Team, comprised of our Vice President, General Counsel and Corporate Secretary, our Executive Director, Accounting and Treasury, and our Executive Director, Information Technology, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: We have a written JFI Information Security Policy setting forth our expectations with respect to the receipt, handling and management of information, and setting forth our process, procedures and standards for achieving those expectations. Our Information Security Policy is reviewed and updated by management at least annually, to align with multiple industry standards, including the National Institute of Standards and Technology Cyber Security Framework and relevant state regulations, including New York's Department of Financial Services Cybersecurity Requirements for Financial Services Companies, and federal regulatory requirements. The JFI Privacy Policy is also annually reviewed and updated by management to align with industry best practices and state and federal regulatory requirements.

companyName: Jackson Financial Inc.

ticker: JXN


text: Our information security function, which is led by our Vice President of Information Technology, or VP of IT, helps identify, assess and manage our cybersecurity threats and risks. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and the our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Our IT Management team reports annually to the Risk Committee on the status of the Information Security Program, including risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents and recommendations for improvements. Quarterly status updates are also provided to the Risk Committee.

companyName: BANNER CORP

ticker: BANR


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each participate in relevant discussions on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed, to the extent applicable.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Our Head of Information Security provides quarterly briefings to our audit committee regarding our cybersecurity risks and activities, such as any recent cybersecurity incidents and related responses (including those of third parties), if any, and cybersecurity systems testing. Our audit committee provides periodic updates to the board of directors that include any material information included in such briefings. In addition, our Head of Information Security provides annual briefings to our board of directors on cybersecurity risks and activities.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: As of December 31, 2024, the Fund is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Fund's business strategy, results of operations, or financial condition.

companyName: BlackRock Private Credit Fund


text: Our CISO is responsible for the overall administration and execution of the information security program and reports to our Chief Risk Officer ("CRO"). Our CISO has over fifteen years of experience working in information security and risk for a variety of companies and organizations, including multiple financial institutions. The CISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The CISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Cybersecurity, resilience and data privacy risks are maintained and managed on an ongoing basis as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity, resilience and data privacy) is designed to assess, identify and manage cybersecurity- resilience and data privacy-related risks and mitigation measures.

companyName: Celanese Corp

ticker: CE


text: Global IT Manager promptly escalates significant cybersecurity matters to the CFO and the Audit Committee, ensuring that the Board remains fully informed. Regular updates to the Audit Committee include detailed discussions on system performance, risk exposure, and planned mitigation strategies.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide training to our employees to help identify potential cybersecurity threats and attacks through an annual cybersecurity awareness month and targeted phishing campaigns. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.

companyName: GRACO INC

ticker: GGG


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP"), designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Blackstone's Legal and Compliance.

companyName: Blackstone Infrastructure Strategies L.P.


text: Our CISO has 23 years of experience in cybersecurity and 17 years in cybersecurity management, received a Bachelor of Science in Management Information Systems and a Master of Business Administration from Rochester Institute of Technology, and is a Certified Information Systems Security Professional. Cybersecurity strategy and updates are reviewed by our executive leadership team on a monthly basis and are presented to other internal committees. The audit committee receives a regularly scheduled report on cybersecurity matters and related risk exposure from our CISO. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: Microvast has established a combination of policies and procedures, and technologies have been designed and implemented, to prevent, detect, respond to, and recover from cybersecurity threats and incidents. Information security policies are regularly reviewed and updated. The policies were created using NIST-CSF framework to ensure that best practices for information security are being adhered to. Internal control tests are regularly performed to test the compliance of the policy processes and procedures and to remediate any identified gaps.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: The Company also maintains an Incident Response Program that establishes security incident response protocols, principally relevant to the Information Security and Information Technology teams, including identification, containment, recovery, and follow up related to security incidents. The Incident Response Program specifies when an incident is deemed a potential information security breach requiring escalation of handling in accordance with the Company's Crisis Communication Plan and Protocols. The Crisis Communication Plan and Protocols supplement the Incident Response Program and, although they may be used as general guidance with respect to a variety of incidents, they are designed to assist the incident response team in responding to an actual or possible systems or data breach incident. In connection with an incident involving an actual or possible systems or data breach, the Crisis Communication Plan and Protocols establish a cross-functional response team to identify incidents, determine whether systems or data have been compromised and, if so, initiate protocols to identify the extent of the incident, contain and mitigate any damage, communicate the incident to all necessary parties (including regulatory agencies and law enforcement agencies, as applicable), maintain the Company's brand integrity, sustain customer trust, and establish the foundation to recover from the incident and rebuild the Company's brand reputation.

companyName: LAKELAND BANCORP INC


text: In addition, we engage third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: As of the date of this Report, we are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Motorsport Games Inc.

ticker: MSGM