text: Our Board of Directors and executive management team oversee cybersecurity risk. Our Chief Information Officer is responsible for day-to-day management of cybersecurity risk. Our Chief Information officer periodically provides reports to executive management and our Board (which receives a report at least annually) on information security, including cybersecurity risk and the prevention, detection, mitigation and remediation of cybersecurity incidents. Our executive management is notified of potentially material cybersecurity incidents according to our cybersecurity incident management procedures.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: Management is responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents as well as the Company's overall information security strategy, policy, and operations. The cybersecurity program is executed by the Company's Senior Vice President of IT Governance, Risk, and Compliance, who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk. He is also responsible for maintaining and, in the event of an actual suspected security incident, executing the Company's WISP.

companyName: Howard Hughes Holdings Inc.

ticker: HHH

secItem: Item 1C


text: The Risk Management Committee of our Board of Directors has responsibility for oversight of the design, implementation, and operation of our enterprise risk management framework, including review and approval of risk management policies and review of our monitoring of risk, the effectiveness of its risk management processes, and material changes in risk. As part of this enterprise risk management oversight, our management team, including the EVP ERM and his team, provides quarterly reporting on our cybersecurity risk domain to the Risk Management Committee. The Risk Management Committee in turn reports on significant enterprise risk management issues to the full Board. In 2024, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition. As further detailed in the "Risk Factors" section In Part I, Item 1A of this Annual Report on Form 10-K, we believe cybersecurity matters could pose a material risk to our strategy, operations, or financial condition. For example, a significant breach of our system security, or that of our third-party service providers, could enable access to Company or customer sensitive or confidential information or assets or could disrupt our business operations. This could result in costs of investigation, remediation and/or payment of a ransom; reputational harm and impairment of customer relationships; loss of revenue and regulatory sanctions and penalties, lawsuits, and potential liability, which could have a material adverse effect on our financial condition and results of operations.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: The Cybersecurity Risk Management section within our 2024 MD&A (Item 7), beginning on page 91 of this report, is incorporated herein by reference.

companyName: FIRST HORIZON CORP

ticker: FHN


text: Our board of directors is charged with overall oversight of our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. However, certain members of management are to report to our board of directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Venu Holding Corp

ticker: VENU


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors ( the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part our overall risk assessment process.

companyName: SITE Centers Corp.

ticker: SITC


text: We believe that our properties have been adequately maintained, are in good condition generally and are suitable and adequate for our business as presently conducted. The extent to which we utilize our properties varies by property and from time to time. We believe that our restructuring efforts have brought capacity levels closer to present and anticipated needs. Most of our manufacturing facilities remain capable of handling volume increases.

companyName: Parker-Hannifin Corp

ticker: PH


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies sponsored by Blackstone such as BXPE. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: Our Board is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Our Audit Committee is charged with reviewing and discussing our policies with respect to risk assessment and risk management, which includes overseeing our major financial, privacy, security, cybersecurity and technology risk exposures and the steps our management has taken to monitor and control these exposures. At the management level, our Head of Cybersecurity and the cybersecurity teams are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our current Head of Cybersecurity has 20 years of industry experience, including serving as an enterprise Chief Information Security Officer for many years and having extensive experience in developing and leading risk management programs. Additionally, our Head of Cybersecurity holds multiple industry standard security certifications, including CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).

companyName: Wayfair Inc.

ticker: W


text: We take an enterprise-wide approach to cybersecurity, using established processes for assessing, identifying, and managing risks from cybersecurity threats. We have implemented various measures across our organization to manage our cybersecurity risks, including implementing systems to identify, prevent, detect, investigate, resolve and recover from cyber security attacks. All employees participate in our security awareness training program, and additional training is required for various roles within the organization. Employees are trained and encouraged to identify and report security concerns, and cybersecurity is engrained in our culture.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature such as data about our research and clinical trials ("Information Systems and Data").

companyName: SCYNEXIS INC

ticker: SCYX


text: Company's computer systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing passwords, protection of Company issued and use of personal devices, managing large data transfers. Employees are directed to immediately contact the Chief Executive Officer if they encounter any suspicious activity.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For a disclosure of our cybersecurity risks, Risk Factors in Part I, Item 1A.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is no t aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect USL, including its business strategy, results of operations, or financial condition.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Crown PropTech Acquisitions

ticker: CPTKW


text: The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management strategy and have been embedded in the information systems operating procedures and internal controls. Our information technology ("IT")

companyName: TREES Corp (Colorado)

ticker: CANN


text: Our SDICS, is responsible for assessing and managing our material risks from cybersecurity threats. The SDICS has primary responsibility for our overall cybersecurity risk management program and has over 25 years of experience leading cybersecurity programs across a variety of industries, including life sciences.

companyName: Metsera, Inc.


text: Board receives reports from our Director of Information Technology on cybersecurity matters on as needed basis. These reports can include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships. As part of the program, our IT governance, risk and compliance team conduct due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: The CSO, the interim Chief Legal Officer and the Chief Research & Software Development Officer are responsible for leading the assessment and management of cybersecurity risks. The current CSO has over 20 years of experience in information security.

companyName: Aspen Technology, Inc.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.

companyName: Delek US Holdings, Inc.

ticker: DK


text: The Nominating and Corporate Governance Committee (the "Committee") and senior management oversee our cybersecurity risk processes and policies. The Committee receives regular reports from senior management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including security risks and information security vulnerabilities. The Committee also ensures that procedures for safeguarding the Company's information technology ("IT") systems are documented and implemented, monitors the effectiveness of the Company's cybersecurity program for protecting against internal and external threats as well as disaster recovery and disruption mitigation, and addresses deficiencies as the threat and business landscape continues to evolve. The Board of Directors receives regular updates from the Committee based on such oversight and communications with senior management regarding cybersecurity risk resulting from risk and control maturity assessments, progress of risk reduction initiatives, external auditor feedback and relevant internal and industry cybersecurity incidents.

companyName: VirnetX Holding Corp

ticker: VHC


text: Our enterprise risk management program incorporates risks related to cybersecurity threats alongside other company risks as part of our overall risk assessment process. We also employ a cybersecurity-specific risk assessment process. Our IT professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals of risk identification and assessment. We also engage experts to attempt to infiltrate our information systems.

companyName: Inari Medical, Inc.


text: The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events or trends impacting the Company. Annually, our CIO, Director of Technical Services and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company's cybersecurity insurance program on an annual basis in connection with the program's renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our platform, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales." We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.

companyName: QUALYS, INC.

ticker: QLYS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security team, which includes our VP of Information Technology, vCISO, and third-party service providers, works with management to prioritize our risk management processes and take steps to mitigate cybersecurity threats that are determined to be more likely to lead to a material impact to our business. Key findings and status of the cybersecurity landscape are reviewed with the Audit Committee of our Board of Directors (the Audit Committee), which evaluates our overall enterprise risk.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: As part of our overall ERM approach, our third-party risk management program is designed to ensure proper risk identification and oversight of Atleos' vendors and includes the following objectives: • Perform risk-based segmentation and prioritization of all existing and new Atleos vendors; • Perform sanctions screenings on all vendors and anti-bribery, anti-corruption screenings on applicable vendors; • Perform extended due diligence on identified high risk vendors to include responsible sourcing, business continuity, information security, data privacy, and other reviews as applicable; and • Perform a financial risk assessment on identified high risk vendors.

companyName: NCR Atleos Corp

ticker: NATL


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cyber risk is addressed as a critical component of the company's enterprise risk management program and is based upon entity-level controls found in our SOC2 compliance program, addressing all five trust service criteria: security, availability, confidentiality, privacy, and processing integrity. The Company recently received an unqualified opinion from an industry-recognized audit firm attesting to our SOC2 Type II compliance as of the date of such report.

companyName: Definitive Healthcare Corp.

ticker: DH


text: We recognize the critical importance of maintaining the trust and confidence of our customers, franchisees and employees. Consequently, our cybersecurity policies, standards, processes and practices are embedded within our overall enterprise risk management ("ERM") program.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) our information security function works with management, including our Chief Technology Officer ("CTO"), to prioritize our risk management processes and mitigate cybersecurity threats that could more likely lead to a material impact to our business; (3) our senior management/committee evaluates material risks from cybersecurity threats against our overall business objectives and on a quarterly basis reports to the cybersecurity subcommittee of the audit committee of the board of directors, with the cybersecurity subcommittee reporting to the audit committee of the board of directors, which oversees our cybersecurity risk as part of our overall enterprise risk.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: The ISP also has a documented Information Security Incident Response Plan (the "ISIRP) to manage any high severity security incidents that may arise. The ISIRP establishes a framework for our information security team to escalate, contain, investigate, and remediate a potential cybersecurity event. The ISIRP is reviewed no less than annually and is integrated into the Company's overall Crisis Management Plan, which is reviewed, led, and tested regularly by senior management.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: As part of our cybersecurity program, we maintain a Cyber Risk Management Program that seeks to address key risk management concepts, including mission and vision, escalation path for risk mitigation, risk assessments, and risk treatment. We do so by conducting a variety of planning and preparedness activities, including employing monitoring tools to identify suspicious or anomalous activity, vulnerabilities, or signs of compromise across our networks, systems, and data. We utilize data from attack surface management tools to produce a prioritized set of vulnerabilities for remediation. We also require mandatory cybersecurity training for employees and periodically conduct Company-wide phishing simulations.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operation, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal and Cybersecurity Risks" within this annual report.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: As part of the above processes, we engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: PROKIDNEY CORP.

ticker: PROK


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Directors, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having a third party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: KINETA, INC./DE


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "—If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.".

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving sets of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this Form 10-K for additional information.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: We are subject to cybersecurity risks, which include intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risks can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. For a discussion of cybersecurity and related risks impacting our Bank, see Risk Factors starting on page 18.

companyName: Federal Home Loan Bank of Chicago


text: Under the oversight of the Audit Committee, and as directed by the Head of IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Our cybersecurity risk management program considers cybersecurity risks alongside other company risks as part of our overall cybersecurity risk assessment process, and shares common methodologies, reporting channels and governance processes that apply to other risks impacting the company, such as regulatory, financial and operational risks.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: The Company's Board of Directors, through its Audit Committee (the "Committee"), working closely with the Company's corporate governance consultant, provides oversight of risks from cybersecurity threats by monitoring incident-based reports from Tuearis as to the existence and severity of such risks. When risks are identified, the Committee works with the Company's corporate governance consultant to develop appropriate responses, based on the recommendations of Tuearis. The Company does not have an employee with specific expertise in cybersecurity risk management but relies on Tuearis to provide that expertise. All material cybersecurity risks, incidents, and responses are reported to the Committee as a routine matter.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: Our comprehensive InfoSec Incident Response Plan is updated at least annually, and provides guidance for detecting, containing, eradicating and recovering from potential incidents. It outlines escalation procedures, reporting requirements, incident severity levels, a materiality assessment and roles and responsibilities for key partners, including IT, Legal/Employee Relations, Corporate Communications, Human Resources and other senior leaders. Our escalation procedures include escalation to our Executive Leadership Team, Audit Committee, Disclosure Committee, and Board of Directors, and reporting to regulators, customers, investors, and others. We also maintain cybersecurity insurance, regularly evaluate the effectiveness of our systems, and test our contingency plans by conducting vulnerability analysis and tabletop exercises with both technical incident responders and senior leaders.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Our Audit Committee is required under its charter to periodically review our data privacy and information security programs. Our Audit Committee assists our Board in oversight and monitoring of our cybersecurity processes, including systems to collect and store confidential information, ongoing initiatives, current threats and our response readiness to cybersecurity attacks.

companyName: NVR INC

ticker: NVR


text: The Board receives periodic reports and presentations from management on our cybersecurity risks and cyber risk management program. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Amplitude, Inc.

ticker: AMPL


text: Our associates, including those responsible for cybersecurity, are evaluated for competence, including the knowledge and skills necessary to accomplish tasks that define associates' roles and responsibilities and undergo regular training regarding privacy, security, ethics and compliance. Our job summaries contain specific educational and knowledge requirements necessary for cybersecurity jobs. In addition, a criminal background check is completed for all new associates and performance reviews are conducted annually to measure performance results and achievements and to assess the job competency of our associates.

companyName: Elevance Health, Inc.

ticker: ELV


text: We have implemented ongoing processes that are designed to continually identify, assess, manage, and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, which work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which are then considered by other officers and employees of our Adviser and Administrator working on our behalf before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes, and procedures.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Threat and Vulnerability Management – Vulnerability scanning and attack and penetration testing, quarterly and annually, is conducted on perimeter networks and E-commerce platforms by third parties and qualified internal personnel. The testing covers network, host, application, and data security. The Company uses the Common Vulnerability Scoring System ("CVSS") standard for vulnerability management. Various open source, third party and internally developed threat intelligence platforms are used to stay abreast of threats facing the Company and our industry.

companyName: CINCINNATI BELL INC


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we rely on such providers to maintain appropriate cybersecurity practices.

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: Certain of our data processing equipment is housed in third-party commercial data centers or on servers owned and operated by cloud-based service providers. We generally enter into service level agreements with these parties that include provisions for the implementation and operation of effective security controls at the third-party organizations. We have experienced, and may in the future experience, whether directly or through our third party providers, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For additional information about our cybersecurity risks, please refer to "Risks Related to Intellectual Property and Technology" in Item 1A, "Risk Factors."

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process. The Audit Committee oversees our cybersecurity program, as well as the steps management has taken to monitor and control cybersecurity threats and related risks. This oversight includes receiving reports on the regular assessments of the Company's disclosure controls and procedures to ensure that current practices account for material cybersecurity risks facing the Company. The Audit Committee receives presentations on the cybersecurity program and related risks on at least a quarterly basis. These presentations address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee, and the full Board as necessary, also receive prompt and timely information regarding any cybersecurity incident that meets recognized established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee routinely meets with our Chief Technology Officer ("CTO") and CISO as well as outside experts as appropriate to assess cybersecurity risks and to evaluate the status of the Company's cybersecurity efforts, which include a broad range of tools and training initiatives that work together to protect the data and systems used in our businesses.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The current cyber threat environment presents increased risk for all companies, particularly companies in our industry, as the volume and intensity of cybersecurity attacks on hospitals and health systems has continued to increase. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we have experienced security incidents from time to time. In particular, on February 13, 2023, we disclosed a security breach in which a third-party vendor that provides a secure file transfer software platform utilized by our subsidiaries experienced a security breach whereby personal information of certain patients of our healthcare facilities were exposed to the attacker.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: The CCO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CCO and the Cybersecurity Management Board, as appropriate. As discussed above, the CCO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.

companyName: General Motors Co

ticker: GM


text: As indicated above, we utilize a risk-based methodology to determine which security controls are appropriate for a particular circumstance, and it is possible we may not implement suitable controls if we fail to perceive, or underrate, a particular risk. Though we have confidence in the security measures and processes we deploy to protect from cybersecurity threats, neither ibex nor others we rely on may be able to completely, continuously, and successfully execute security controls as intended.

companyName: IBEX Ltd

ticker: IBEX


text: The Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. Further, we also carry third-party cybersecurity insurance.

companyName: Mission Produce, Inc.

ticker: AVO


text: The Company's board of directors has overall responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The audit committee provides oversight of the Company's cybersecurity, information security and technology risk exposures, including the steps management has taken to identify, assess, monitor and control cybersecurity risks.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: The Company's Cyber Security Committee, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that the Company's Chief Information Officer and its Chief Information Security Officer, in coordination with the Company's Cyber Security Committee, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee are also informed of identified cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding each such incident until it has been addressed. The Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Officer, and, as necessary, the Company's Chief Information Officer meets with the Audit Committee to discuss cybersecurity risk management.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: The Company's EVP – Global Business & Information Services reports to the Chief Executive Officer and has 35 years of experience leading information technology functions, which includes information security and incident management prevention and response. Under the direction of the EVP – Global Business & Information Services and the Chief Executive Officer, the internal team within the Company's Information Services department analyzes cybersecurity risks, considers industry trends, and implements controls, as appropriate, to mitigate these risks.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. With that objective, the Company undertook a focused cybersecurity assessment conducted by an independent cybersecurity advisory firm to better understand the current cybersecurity threats and risks necessary to establish the foundation of a cybersecurity risk assessment framework appropriate for its current business operations and needs.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for the Annovis management and Board of Directors. We continue to invest in cybersecurity and enhance our internal controls and processes, which are designed to help protect our systems and the information they contain.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: e. Conduct regular phishing email simulations for employees; and f. Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Independence Contract Drilling, Inc.


text: Cybersecurity is a key component of the Company's overall risk management system, and the Company believes it has implemented robust processes that are designed to effectively manage risks from cybersecurity threats. Domino's cybersecurity program is embedded into the Company's enterprise risk management framework from both a resource allocation and strategic initiative perspective and is supported by an extensive catalog of layered security controls that are designed to prevent and detect internal and external security threats and safeguard privacy and personal data of customers, team members, franchisees and other business partners. Domino's maintains this comprehensive information security program with a dedicated team that is responsible for directing, coordinating, planning and organizing information security activities throughout the Company and is led by the Company's CISO.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Preventive Controls and Monitoring: We employ multiple layers of technical controls (firewalls, intrusion detection systems, encryption, and multi-factor authentication) to proactively monitor IT controls to ensure compliance with security policies, legal regulations, contractual obligations and industry best practices. Our Global Security Operations Center operates 24/7 with real-time monitoring capabilities to rapidly investigate alerts and trigger containment measures, which helps us minimize exposure or damage if a cybersecurity incident occurs.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. The Board receives regular reports from our Vice President Director of Information Security on various cybersecurity efforts, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. In addition, we have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design a layer of controls as a baseline. We conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our Information Systems and Data to identify vulnerabilities and potential threats. Our cybersecurity program also includes third-party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third-party vendors and service providers, particularly focused on vendors who process sensitive information. In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives are designed to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and communications about cybersecurity topics and threats.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Energy Vault's CIO has more than 25 years of cybersecurity and risk management experience across multiple market verticals, including extensive experience overseeing critical and complex cybersecurity teams spanning multiple federal agencies and private industry. Further, the Audit Committee has a combined twelve years of experience in organizational cybersecurity and risk management.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: Due to our size and the size of our employee base, we use third-party vendors to assist us with our network and information technology requirements. Since 2019, BDO USA, LLC ("BDO") has acted as our outsourced chief technology officer/chief information security officer ("CTO/CISO") and provided us with the following services: • Overseeing the chief security role and informing leadership of cybersecurity risks and the role of staff in protecting information, including, but not limited to: Monitoring emerging risks, and suggesting and overseeing implementation of mitigations; Overseeing security awareness and training programs; and Reporting significant security events to leadership.

companyName: LXP Industrial Trust

ticker: LXP


text: Management is responsible for identifying, considering and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our Vice President of Information Technology is tasked with establishing processes to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technology receives reports from our cybersecurity team and oversees the monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents, if any. In addition, our Vice President of Information Technology reports cybersecurity incidents to our compliance committee, which is composed of relevant members of management, and, where appropriate, to the audit committee.

companyName: Karuna Therapeutics, Inc.


text: To address evolving security threats, Deutsche Bank Group continually reviews and enhances its information security controls into every layer of technology, including identity and access management, data, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to provide end-to-end protection, as well as multiple opportunities to detect, prevent, respond to, and recover from cyberthreats.

companyName: RREEF Property Trust, Inc.


text: While we work closely with accredited third-party cybersecurity firms, where appropriate, to audit our security architecture, our Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing our cybersecurity risk assessment processes, our security processes, and our response to cybersecurity incidents.

companyName: SKYWEST INC

ticker: SKYW


text: Our enterprise risk management program, led by a team of senior executives, includes the performance of an annual risk assessment made at the corporate center and operating company levels, and is designed to identify enterprise level risks we may face, including cybersecurity risk at a high level. Each quarter, this team reassesses the identified enterprise risks, the severity of these risks, and the status of efforts to mitigate them. We also engage consultants and other third parties for periodic risk and vulnerability testing and assessment. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.

companyName: DOVER Corp

ticker: DOV


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the IT department works with management to prioritize our risk management processes and to mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: CHIMERIX INC


text: Our Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), and Vice President of Cybersecurity, all within our "CIO organization," lead our Detection and Response Team ("DART") which is responsible for our cybersecurity incident response processes pursuant to our Incident Response Plan and playbooks. The DART also includes members of our IT department responsible for supporting the technologies and processes to protect against, detect, contain, mitigate, and recover from cybersecurity incidents. The DART evaluates and assigns severity levels to cybersecurity incidents and, based on the severity, escalates and engages incident response teams to respond to and mitigate the risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Senior members of our management are responsible for assisting our CTO and CISO in managing cybersecurity risk. We maintain a cross-functional Enterprise Risk Management Committee, which meets monthly to identify, assess, mitigate, and remediate risks impacting the Company, including cybersecurity risks. Members of this committee include our CISO, CTO, Chief Financial Officer, Chief Privacy Officer, General Counsel, Chief Commercial Officer, Chief Scientific Officer, Chief Medical Officer, Chief Legal Officer, and the heads of our Regulatory and Quality teams. The Enterprise Risk Management Committee informs members of the Audit Committee regarding the overall enterprise risks identified by management, progress on remediation efforts identified in the prior quarter, and risk mitigation priorities for the forthcoming quarter.

companyName: Tempus AI, Inc.

ticker: TEM


text: We have implemented and continue to maintain our IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an IT acceptable use policy, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Company's use of third-party service providers who may have access to sensitive Company data and systems.

companyName: CVR ENERGY INC

ticker: CVI


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") Framework. As part of our ERM Framework, we maintain the traditional Three Lines Model (Management, Risk & Compliance and Internal Audit) to delineate accountabilities and establish a 'check and balance' management of risks. For additional information on our ERM Framework, refer to "Item 1. Business - Enterprise Risk Management."

companyName: Enstar Group LTD


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Stride, Inc.

ticker: LRN


text: The Governance and Technology Committee of the Board ("GTC") oversees Signet's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Two of the members of our GTC are technology executives employed at their respective organizations who are highly technology-fluent and well-versed on cyber risks. The CISO and CIO regularly brief the GTC on the effectiveness of Signet's cyber risk management program and risk status. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk-mapping exercise. In addition to scheduled meetings, the GTC, CISO and CIO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: We engage third parties to perform regular reviews of our security controls which includes 24/7/365 security incident and event management as well as vulnerability services and penetration testing. Our processes to identify, assess and manage material risks from cybersecurity threats include risks associated with our use of third-party service providers, including cloud-based platforms. We oversee and identify cybersecurity risks from our third-party service providers in a number of ways, including appropriate due diligence in connection with service provider onboarding, robust security terms and conditions in our third-party service provider contracts and ongoing risk-based monitoring to ensure compliance with our cybersecurity standards. We believe that these policies and controls provide us with an appropriate assessment of potential cybersecurity threats.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: If an incident is detected, our cybersecurity team follows the incident response policy to investigate, review and determine the potential impacts of such an incident. If the cybersecurity team determines that an incident could reasonably be expected to have an impact on the financial condition or operations of the Company, it escalates the incident to the crisis management team, which includes executive management. The crisis management team further evaluates the potential impact and materiality of an event and the appropriate response required. The crisis management team coordinates the appropriate response effort and communicates, as applicable, to the Audit Committee. To the extent that cybersecurity incident is determined to be material, the appropriate public disclosures are made.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery;

companyName: Power REIT

ticker: PW


text: To date, we have not experienced any known material cybersecurity breach or threat that resulted in or is reasonably likely to result in any material loss, or any material impact on our business strategy, results of operations or financial condition.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Cyber Risk Exposure Our top cyber risks have been grouped into genericized categories to avoid disclosure of sensitive information but include sufficient detail for a reasonable investor to understand our cyber risks and maintain confidence we act in good faith to reduce our cyber risk exposure. In the fourth quarter of 2024, we performed a risk analysis of all critical assets, determining the following are our current top cyber risks, none of which are material: Compromise to the confidentiality of intellectual property. Compromise to the confidentiality and integrity of financial records. Compromise to the confidentiality of employee records. Compromise to the confidentiality, integrity, and availability of core business systems. Compromise to the confidentiality, integrity, and availability of critical third-party vendors supporting the continuity of business operations.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Current Cybersecurity Risk Posture To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see "Item 1A. Risk Factors - Our business and operations would suffer in the event of system failures."

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.

companyName: Fintech Scion Ltd


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third -party security software and technology services. In addition, we use third -party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Risk Management and Strategy Atmos Energy's cybersecurity program leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) in its design of controls intended to reduce the risk and potential impact of cybersecurity incidents. This comprehensive approach encompasses continuous monitoring, risk assessments, a cybersecurity incident response plan, and regular evaluations to align our practices with industry standards. Additionally, we actively engage in cybersecurity risk management practices and continually improve procedures and practices to support the continued safe and reliable delivery of natural gas to our customers.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: Our Cybersecurity Program is governed by the Company's IT and Legal and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsels regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsels report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to CEO, and a status of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.

companyName: Fluent, Inc.

ticker: FLNT


text: To ensure the effectiveness of the cybersecurity program, we have implemented various assurance methods including ongoing internal audit control reviews, external reviews by third-party consultants including penetration testing, and cyber incident response team exercises. Ongoing monitoring of our systems and security metric reviews are in place to manage external threats. Our cyber monitoring and supporting metrics include such areas as intrusion detection, phishing attempts, cyber training results, and patch management vulnerabilities. Additionally, the Company collaborates with industry associations, government authorities, peers, and external advisors to monitor the threat environment to ensure no gaps exist in our security practices.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: The CITO, who has served in this role for over nine years, regularly reports cybersecurity updates to our Chief Operating Officer who, in his dual role as Chief Financial Officer, is our primary liaison with the Audit Committee. To inform about these updates and help guide cybersecurity related activities across our organization, the CITO has assembled a cybersecurity focus group and steering committee that meets on a quarterly basis and is made up of experienced representatives from various of our cybersecurity risk management consultants, external network security experts and cloud storage providers. These meetings are chaired by the CITO and include discussion of our cybersecurity needs, taking into account the latest industry trends.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Chief Financial Officer has operational responsibility for oversight of our outsourced information technology services, our information security programs, protections, and efforts, along with leading efforts for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. We anticipate that our outsourced services will update the Chief Financial Officer and Chief Executive Officer on these matters and work closely with these Senior Executives to oversee compliance with legal, regulatory, and contractual security requirements with the guidance of outside counsel.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is included in discussions with the Audit Committee of our Board of Directors and disclosed where appropriate. Our information technology and cybersecurity function is headed by our Chief Executive Officer ("CEO"), and Vice President of Information Technology, who are responsible for managerial oversight of our cybersecurity program. Our Vice President of Information Technology reports directly to our CEO.

companyName: HARROW, INC.

ticker: HROW


text: The Company has implemented a cybersecurity incident response plan that is designed to provide controls and procedures to facilitate timely and accurate reporting of a material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by our third party cybersecurity provider, who would promptly inform the Company's EDA. If a cybersecurity event meets certain criteria, the EDA escalates it to our management team, including our Chief Executive Officer and Chief Financial Officer. The incident response plan also contains procedures for escalating cybersecurity incidents to the Chairman of the Board and the Audit Committee.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Information Technology Manager and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.

companyName: Nutex Health Inc.

ticker: NUTX


text: Company also maintains a training program ("Training Program"), which is designed, implemented, and maintained by the Company's Director of Information Security. This Training Program reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies and engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Training Program training is mandatory for all employees at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic phishing campaigns.

companyName: Inspired Entertainment, Inc.

ticker: INSE


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: CHUY'S HOLDINGS, INC.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Tesla, Inc.

ticker: TSLA


text: Our Chief Information Security Officer ("CISO") leads our global Security Operations Center and has over 20 years of experience in cybersecurity, including serving in similar roles at other public companies. Our CISO reports to our Vice President of Information Technology who has 28 years of experience in Manufacturing and Financial Services and has been leading our IT function for 14 years. Our Vice President of Information Technology reports to our Chief Financial Officer. Our employees supporting our information security program have relevant educational and industry experience.

companyName: Amcor plc

ticker: AMCR


text: We contract with third-party security monitoring services, performing active, automated searches of indexed darknet databases. Additionally, we perform quarterly vulnerability scans against our network infrastructure and systems exposed to the Internet. The Company also participates in a cybersecurity risk insurance policy.

companyName: MAXLINEAR, INC

ticker: MXL


text: To stay abreast of the evolving threat landscape, we actively engage with key vendors, industry information sharing, and intelligence and law enforcement communities. These engagements serve as inputs into understanding techniques and tactics being used by threat actors and in expanding the countermeasures we use to protect Teladoc Health.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: Summit Materials, LLC


text: While all employees, including members of our information technology ("IT") team, are required to report any known or suspected security event, pursuant to our policies and procedures, the following members of Company management and the Board of Directors are tasked specifically with the responsibilities described below: • Cybersecurity Incident Response Team ("CIRT") – The CIRT was established to provide quick, effective, and orderly responses to serious successful cybersecurity related incidents such as system and application outages, virus infections, hacker attempts, system compromises, improper disclosure of confidential information, system service interruptions, breach of personal identifiable information, or other technology related events with serious security implications or business disruptions.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Our management evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed on a periodic basis as deemed appropriate.

companyName: Nano Nuclear Energy Inc.

ticker: NNE


text: Given the importance of maintaining the security of the Company's systems and information, cybersecurity risks are also reviewed and addressed relative to assessing new products and services and any third-party services providers that may be engaged to provide systems and services to the Company. As an essential element of the Company's cybersecurity program, the Company maintains a third-party service provider management program that assesses and addresses the risks associated with third parties providing systems, software and programs that access the Company's information. As part of this oversight, the Company's Risk Management, Legal and/or Information Security Departments review higher risk and material contracts with third party service providers, which includes an evaluation of the cybersecurity risks presented, any safeguards, and service organization controls reports provided by the third parties. Initial and continuing due diligence is also conducted on third party service providers to ensure that they are fulfilling their contractual obligations and satisfying the Company's data security requirements.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: The company's risk management programs for cybersecurity are integrated into the company's enterprise risk management and general compliance programs and processes.

companyName: Corteva, Inc.

ticker: CTVA


text: We maintain a cybersecurity program designed to protect our information, and that of our customers, suppliers and other third parties we engage with, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: The Company's CISO has over 26 years of building and operating enterprise security functions, security engineering, and security governance and program management. Prior to joining the Company, the CISO managed an Information Security and Risk Management program within a Fortune 500 energy company that handled a wide variety of information security issues including industrial control system security. The CISO has also served on the board of several academic institutions, professional service organizations, and local non-profits and contributed on many special committees for cybersecurity initiatives.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Our Audit Committee of the Board is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Our management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology and cybersecurity personnel and our third-party vendors. Our management team supervises efforts to prevent, detect and mitigate cybersecurity risks and incidents through various means, which may include briefings from both internal and external information technology and cybersecurity personnel, threat intelligence and other information obtained from governmental, public or private sources as well as alerts and reports produced by security tools deployed in our information technology environment.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: TEGNA uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has clearly defined policies and standards for all employees and technical systems. We use external subject matter experts to provide independent assessments of the cybersecurity program. Following the NIST Cybersecurity Framework, TEGNA utilizes internal reporting, policies, software, training programs, secure software development coding practices and hardware solutions to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion, detection and prevention systems, vulnerability and penetration testing and identity management systems. Our network is continuously monitored using prevailing industry tools, and our cybersecurity team promptly investigates any anomalies. TEGNA has an extensive patching and software update program, and performance metrics are reported to our Board. All new employees are required to take a cybersecurity training course, and we have mandatory quarterly training modules for all employees.

companyName: TEGNA INC

ticker: TGNA


text: As of the December 31, 2023, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.

companyName: Bristow Group Inc.

ticker: VTOL


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We are subject to cybersecurity attacks, which could adversely impact our results of operations and financial position" in this annual report on Form 10-K.

companyName: MASCO CORP /DE/

ticker: MAS


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by the IT Committee. The members of the IT Committee collectively have over fifty years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers in both operations and IT infrastructure leadership roles. Third-party consultants with specific education and over 25 years' experience in IT Infrastructure and Cybersecurity are utilized to provide additional technical insight and recommendations. The IT Committee is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Oversight of Third-Party Providers Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including how our data is stored, accessed, and transmitted. In addition, all providers within these service categories must execute a data security addendum that articulates specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Head of IT, who has experience in various roles involving information technology and cybersecurity. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee on any appropriate items.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: The IT Steering Committee is responsible for assessing and reviewing our information security program and the Company's material risks from cybersecurity threats. Additional supervision and management is provided by our IT Leadership team, comprised of our SVP, IT; VP, IT Infrastructure and Operations; VP, IT Enterprise Applications; and International IT Director.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: The CISO leads the Corporate Information Security organization which oversees the security posture of Jabil's data, networks, and resources. The CISO is responsible for notifying and providing updates on cybersecurity incidents to the Chief Information Officer ("CIO"). The CIO is responsible for overseeing global IT operations and digital transformation across the Company and leads the strategic direction on IT polices to safeguard company and client assets against cybersecurity threats.

companyName: JABIL INC

ticker: JBL


text: We assess our cybersecurity risk management program at least annually and regularly review our cyber incident response plan. Our processes and policies also include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats. We also partner with industry leading third parties for regular security audits to ensure we view cybersecurity with a holistic perspective.

companyName: Invitation Homes Inc.

ticker: INVH


text: Outside of the normal course of business, in the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company's Chief Legal Officer, Chief Administrative Officer, and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident's potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope. Our Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions and has earned a Master of Business Administration and also a Master of Science degree in Accounting with a Management Information Systems concentration.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.

companyName: DIH HOLDING US, INC.


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Board of Directors regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third-party service providers, as applicable.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Southwest Gas' cybersecurity program focuses on people, processes, and technology, and takes a defense-in-depth approach by seeking to align with industry best practices. We invest in annual cybersecurity awareness training and testing for employees, by means of which we teach employees about remaining vigilant in daily work activities and practicing good security awareness. Specialized cybersecurity training is provided to those in specific job functions particularly susceptible to cyber incidents and phishing simulations are conducted monthly. Annually, a cybersecurity fair is held, and every employee is encouraged to participate. During this fair, outside experts present current and relevant information in an engaging and educational atmosphere. Tabletop exercises are periodically conducted to evaluate controls, processes, and procedures within Southwest Gas and with our partners in the handling of a cybersecurity incident. Southwest Gas maintains partnerships with law enforcement and other participants within the natural gas and electric utility industries. We also participate in the Information Sharing and Analysis Center to share threat intelligence and collaborate on cybersecurity issues affecting our industry.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: The audit committee receives regular reports from the Chief Information Security Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Confluent, Inc.

ticker: CFLT


text: Program Adjustments. The CISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the shared services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Senior Vice President-Finance and Senior Vice President. These officers do not have IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is, required to be made).

companyName: BRT Apartments Corp.

ticker: BRT


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our Head of Cybersecurity, Risk & Trust ("Head of Cybersecurity"). Our Head of Cybersecurity has almost 25 years of cybersecurity, information governance, and IT experience in the technology industry.

companyName: Sonos Inc

ticker: SONO


text: Engagement of Third Party Advisors We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide cybersecurity, privacy, and fraud training on an annual basis.

companyName: KEYCORP /NEW/

ticker: KEY


text: Engagement of Third Parties on Risk Management We engage with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: Palladyne AI Corp.

ticker: PDYN


text: Our information security program is based on written risk assessments that identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of our information systems and information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of these systems. Our risk assessments are developed from industry best practices and include criteria for evaluating and categorizing identified security risks or threats based on the likelihood and potential impact of the threat. Our information security program continuously assesses the sufficiency of our safeguards to control potential risks. Additionally, as part of our risk assessment system, we regularly measure, analyze, and report security and risk metrics. We have invested and continue to invest in risk management measures in order to protect our information systems and information.

companyName: PRA GROUP INC

ticker: PRAA


text: The Company's CISO directs the company's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CISO supports the information security risk oversight responsibilities of the Board and its committees. The CISO is also responsible for the Company's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. The Information Security team examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Like other major corporations, we are the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "If we fail to keep our customers' information confidential or if we handle their information improperly, our business and reputation could be significantly and adversely affected" in Item 1A. Risk Factors of this Annual Report.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: The Company also engages external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These experts include cybersecurity consultants that we engage as part of our continuing efforts to evaluate and improve the effectiveness of our Cybersecurity Program, and other cybersecurity service providers that help secure our systems and networks. The Company also uses specialized third-party software tools to identify, monitor and mitigate risks from cybersecurity risks.

companyName: ITERIS, INC.


text: As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: We are in the process of implementing our cybersecurity program, which is aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and is designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our cybersecurity efforts is a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: Onconetix, Inc.

ticker: ONCO


text: The Board factors in the input towards security and compliance program budget to strike a balance between the expense and corresponding risk.

companyName: Crexendo, Inc.

ticker: CXDO


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks. Governance.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, if necessary, we would re-design and implement reasonable additional safeguards to minimize identified risks and address any identified gaps in existing safeguards.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS