text: Management's Responsibilities Our cybersecurity risk management program is led by our CISO, who is responsible for our information security strategy, policies, compliance, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CISO, a Certified Information Systems Security Professional ("CISSP"), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: The underlying controls of the cyber risk management program are based on recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27002 framework and code of practice for information security controls to establish, implement, and improve an Information Security Management System focused on cybersecurity.

companyName: CBIZ, Inc.

ticker: CBZ

secItem: Item 1C


text: Company's cybersecurity environment is led by our third-party information technology (IT) contractor, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. The IT contractor is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats.

companyName: Royale Energy, Inc.

ticker: ROYL


text: We have implemented comprehensive information security processes to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware, software, and critical data, including intellectual property and confidential information ("Information Systems and Data"). Our Information Technology ("IT") team plays a key role in identifying, assessing, and managing cybersecurity threats to our Information Systems and Data, including potential system disruptions, shutdowns, or unauthorized disclosures due to cyber-attacks.

companyName: Avid Bioservices, Inc.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The nominating and corporate governance committee of our Board of Directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: LUMOS PHARMA, INC.


text: Our cybersecurity incident response and vulnerability management plans are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CTO, General Counsel and CEO. Our CTO, General Counsel and CEO work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management plans include reporting to the Audit Committee (who may consult with our technology committee) for certain cybersecurity incidents.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Company regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors.

companyName: SOLESENCE, INC.

ticker: SLSN


text: The Company's IT Engineer, CEO, CFO and Compliance Director each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Emeren Group Ltd


text: Our board of directors will receive periodic reports from management and its designees concerning our significant cybersecurity threats and risks, and the processes we plan to implement and/or have implemented in an effort to address them.

companyName: Peraso Inc.

ticker: PRSO


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that includes our CTO and General Counsel and, if appropriate, our COO and CFO, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.

companyName: VECTOR GROUP LTD


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. Such risks may include harm to our employees or customers, violation of privacy laws, theft, fraud, extortion as well as legal and reputational risk. See Item 1A. Risk Factors, "Our networks and those of our third-party service providers and customers may be vulnerable to cyber-attacks and other security breaches, which could have significant negative consequences." for further discussion.

companyName: Globalstar, Inc.

ticker: GSAT


text: The Executive Director of Information Security & Compliance, with oversight from the Audit Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Executive Director of Information Security & Compliance monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee and Board when appropriate.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Our corporate information security team, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, security operations (as a second line of defense) and cyber threat detection and response. The current CISO has more than ten years' experience in cybersecurity and 35 years as an information technology professional. Given that our CISO has more than 25 years at the Company in multiple positions, he helped incubate and grow our corporate information security team into what it is today. During 2024 Altair chose to grow its security team further, recognizing the ever-increasing threats; a Director for IT Security was brought on board and a number of global staff were added to the Security Operations team. Our information security management philosophy is one of cyber risk prevention and we have the ultimate goal of preventing cyber incidents. Simultaneously, our information security team focuses on increasing our system resilience to minimize data breach (or other compromise) business impact should an incident occur. Cybersecurity is not the sole responsibility of our information security team. During 2024 and into 2025 we have increased the Security team involvement with business leaders. Our Security team works closely with internal departments to keep security at the forefront. Our employees and vendors also play a role in our company's cybersecurity efforts. Through our cybersecurity awareness training and other team training we are fostering a culture that all employees and vendors have a role in our cybersecurity defenses.

companyName: Altair Engineering Inc.


text: We recognize the critical importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), has day-to-day responsibility for our cybersecurity programs. Given the significant risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

companyName: Repay Holdings Corp

ticker: RPAY


text: We maintain cybersecurity insurance coverage in amounts that we believe are adequate to address any incidents such as data destruction, extortion, theft, hacking, denial of service attacks and other such incidents. more information concerning the risks that we face from cybersecurity threats, please see Part I, Item IA, "Risk Factors".

companyName: Legacy Education Inc.

ticker: LGCY


text: Our management committee on cybersecurity, which includes our Chief Financial Officer and members from finance and IT, is primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Financial Officer has had supervisory responsibilities over IT for over 30 years and personally engages our employees in training for cybersecurity. Our lead IT Senior System Engineer has over 20 years of direct IT employment and is a Microsoft Certified System Engineer, a Cisco Certified Network Associate and a Sun Certified System Administrator. One of our Controllers has over 15 years of Sarbanes Oxley compliance training and auditing, including auditing compliance regarding IT. Our VP Finance and Corporate Controller has over 20 years as an employee of AXT and has a thorough understanding of our specific IT systems.

companyName: AXT INC

ticker: AXTI


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) program. Management is responsible for assessing and managing risk, including through the ERM program, subject to oversight by our BOD. Our cybersecurity policies and practices are aligned with NIST (National Institute of Standards and Technology) industry standards.

companyName: PFIZER INC

ticker: PFE


text: Our full Board of Directors provides oversight of our cybersecurity risk management program and will receive updates on the program from IT manager on a quarterly basis, or more frequently as appropriate. Those updates will include information regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including any learnings from external cybersecurity incidents.

companyName: Massimo Group

ticker: MAMO


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products."

companyName: Blue Owl Real Estate Net Lease Trust


text: Monitoring Cybersecurity Incidents The CISO is continually informed of and monitors cybersecurity risks and incidents through real-time updates, including a partnership with a managed security service provider. Periodic Information Security Committee meetings cover key metrics and risk indicators, penetration test results, risk assessment results, status of ongoing initiatives, incident and notable event reports, compliance with regulatory standards, and operational issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the CISO or the CISO's designee, who in turn engages with the corporate Incident Response Team (IRT) to respond to the incident. The CISO is also responsible for informing the Information Security Committee of cybersecurity incidents, which in turn reviews the impact of incidents and monitors the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notice to the Risk Committee of the Board of Directors. These processes assist management and the Risk Committee in staying informed of and monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: Peak Bio, Inc.


text: Third Party Risk Assessments - We conduct information security assessments before sharing or allowing the hosting of data in computing environments managed by third parties or allowing third parties to connect to our environment. We also review and amend legal terms and conditions to ensure there are contractual provisions requiring certain security protections and incident reporting. We also perform vendor risk assessments to assess the risk of new and existing vendors we conduct business with.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: We maintain a team of internal and external information technology specialists who are responsible for the design, implementation, and operation of our information technology ecosystem and cybersecurity governance processes. We engage with certain external parties, including consultants, computer security firms and risk management advisors, peer companies, and industry groups in an effort to enhance our cybersecurity oversight and risk management strategy. We also use security technologies, including third-party solutions and monitoring tools that are designed to identify and mitigate cybersecurity risks. Further, we regularly engage third parties to conduct penetration testing, security assessments and tabletop exercises. We also engage a virtual chief information security officer ("vCISO") to support and advise on our cybersecurity program. We have a process to consider the internal risk oversight programs of critical third-party service providers, including through security questionnaires and contractual requirements, as appropriate. In addition, in an effort to deter and detect cyber threats, we have implemented an annual training program to provide employees with data protection, cybersecurity and incident response and prevention training.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: Board considers cybersecurity risk as part of its risk oversight function and receives regular updates from the management team on our cybersecurity risks and in addition, management updates the Board where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: TAITRON COMPONENTS INC

ticker: TAIT


text: The Company has engaged third-party cybersecurity service providers and leverages leading technologies and expertise to monitor, maintain, and provide 24/7 managed detection and response capabilities for coordination, escalation and remediation of alerts associated with information technology systems utilized by the Company.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: We regularly assess and monitor our cybersecurity risks and incidents and report them to our senior management and Audit & Finance Committee. Our Audit & Finance Committee oversees our cybersecurity strategy and governance and reviews our cybersecurity policies and practices on a periodic basis. Additionally, and as further discussed above, the Audit & Finance Committee is briefed multiple times a year or as needed by the CISO and/or CIO and, if applicable as determined by the Company's senior leadership, external advisors on the current and emerging cybersecurity threats and trends and the effectiveness of our cybersecurity controls and response capabilities.

companyName: Endo LP


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's ("FFIEC"), the National Institute of Standards and Technology ("NIST"), and other agencies providing guidance in this area, as well as by engaging experts to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: The cybersecurity risk management program is led by the Company's Chief Information Officer ("CIO") who has over 20 years of experience in information systems, cybersecurity, and data protection. The CIO reports to the Company's Audit Committee at least annually, as well as to the Board of Directors, the Company's Chief Executive Officer, and other members of our senior management as appropriate. These reports may feature an overall assessment of the Company's compliance with the Company's cybersecurity policies and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board.

companyName: NOVAVAX INC

ticker: NVAX


text: We will leverage internal and external resources to support our cyber risk management efforts, such as vulnerability assessments, and employee cybersecurity awareness training. We will engage the services of external information security service providers to help support our information technology environment, assist with security monitoring, and help us draft and implement information security policies when necessary and/or appropriate. Further, we will utilize third parties to help us monitor issues that are internally discovered or externally reported that may materially affect our website and email systems, and we have processes to assess the potential cybersecurity impact or risk of these issues.

companyName: Smart Powerr Corp.

ticker: CREG


text: The Company maintains an extensive and structured enterprise risk management ("ERM") program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective.

companyName: First American Financial Corp

ticker: FAF


text: Our cybersecurity program is managed and directed by our Head of Information Technology, or IT, who has nearly thirty years of experience in information technology and information systems management. Our Head of IT reports to our Chief Legal Officer and Secretary. Our Cybersecurity Governance Team, which is made up of representatives from across the organization, is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan outlines incident response requirements, reporting processes, protocols for incident evaluation, and procedures for notifying and escalating information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: The Audit Committee of the Board of Directors, or the Audit Committee, oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk advisory services, brief the Audit Committee on cyber threats and vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends, internal assessments and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. Our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: We engage and rely upon third parties to provide services and/or goods, represent and/or otherwise act on our behalf. Prior to engaging or conducting any business with or on our behalf, such parties undergo a due diligence review, and a third party security risk assessment is conducted to validate they are legally permitted and qualified to maintain appropriate safeguards to protect our information assets in connection with the services they intend to provide. We perform supplemental reviews as necessary commensurate with the risk associated with each third party, for example, if or when a third party is affected by an incident, that directly or indirectly impacts our company we undertake a full assessment and implement additional controls commensurate to the risk. Furthermore, to minimize risks and vulnerabilities to our systems, our cybersecurity team continuously monitors and addresses cybersecurity threats and incidents at third-party service providers.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by our Manager's Chief Compliance Officer and Cyber Security Committee ("CSC").

companyName: Terra Property Trust, Inc.

ticker: TPTA


text: On a day-to-day basis, our CISO leads our cybersecurity program with support from senior leadership. Our Information Security program is a bespoke program created for the Company and is guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Information Security team is composed of three core functional areas, which work collaboratively to seek to keep our assets secure: • Governance, Risk, & Administration. Responsible for setting policy, maintaining and conducting risk assessments, ensuring regulatory compliance in partnership with our legal and compliance team, coordinating audits, evaluating new technology platforms, and the development and oversight of the Company's data governance, vendor risk management, and training programs. • Security Operations. Responsible for monitoring our security posture on an ongoing basis, including alert response and escalation. This team is supported by a third-party security firm that serves as the Company's Security Operations Center and performs continuous (24x7x365) monitoring of security across the enterprise. • Security Architecture. Responsible for managing and maintaining security systems and identity management programs, as well as oversight and performance of security reviews for key technology platforms.

companyName: Evercore Inc.

ticker: EVR


text: The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: The GISO reports to our Risk Committee and ESC on cybersecurity risks. Our Chief Information Security Officer (CISO) meets with the ESC and Risk Committee periodically in an effort to review the company's cybersecurity risks, the company's prevention, detection and remediation efforts of cybersecurity incidents (as appropriate), and key cybersecurity performance indicators. We also maintain procedures designed to escalate certain cybersecurity risks and incidents to members of executive management and the board of directors, as appropriate.

companyName: Everpure, Inc.

ticker: PSTG


text: The Company emphasizes continuous risk evaluation and mitigation to improve the Cybersecurity Risk Management Program's resilience and to instill a culture of vigilance across the Company's business. To promote employee awareness of best practices, the Company socializes policies and tips through its intranet site, sends regular phishing simulations, emails newsletters and hosts cybersecurity learning exercises, all in addition to standard company-wide cybersecurity awareness trainings. The Company also participates in various cybersecurity network memberships, including: • H-ISAC: a global cybersecurity best practice-sharing and threat intelligence network for health care stakeholders and • Domestic Security Alliance Council: a partnership between U.S. government agencies and private sector organizations that exchanges security and intelligence information.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, patients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management, or ERM. Our cybersecurity policies, standards, processes and practices continue to be incorporated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: VERACYTE, INC.

ticker: VCYT


text: In addition, we emphasize a company-wide culture of cybersecurity awareness. Employees are required to participate in mandatory training sessions at least annually, covering topics such as phishing recognition and threat response protocols. Other regular and ongoing security communications are also provided to reinforce these lessons and ensure that cybersecurity remains a priority at every level of the organization.

companyName: Karat Packaging Inc.

ticker: KRT


text: bMembers of the Cybersecurity team possess a diverse range of expertise, including prior work experience in cybersecurity, and specialized knowledge and skills in cybersecurity.

companyName: IREN Ltd

ticker: IREN


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including the review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats, and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section titled "Risk Factors—Risks Relating to our Business—Security breaches, unauthorized access to or disclosure of our data or user data, other hacking and phishing attacks on our systems or those of third parties upon which we rely, or other data security incidents could compromise sensitive information related to our business or users processed by us or on our behalf and expose us to liability, which could harm our reputation, generate negative publicity, and materially and adversely affect our business."

companyName: Grindr Inc.

ticker: GRND


text: Our Senior Director Infrastructure, Operations and Cyber Security is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: The cybersecurity program is overseen by the Chief Information Security Officer ("CISO") reporting to the Chief Risk Officer ("CRO"); the Enterprise Risk Management Committee, which consists of the CEO, CFO, and CTO among others; and the Enterprise Risk Committee of the Board of Directors, which consists of three independent directors. Our Board of Directors includes members who have expertise in cybersecurity, data privacy law, fraud and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO, who has extensive experience in the Information Technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's extensive knowledge and experience in the cybersecurity field are critical to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards, Disaster Recovery, Business Continuity, and Incident Response efforts. Additionally, the Bank's Risk Management function is led by the CRO, who has extensive experience in risk management and audit. The cybersecurity program includes a cross-sectional team of internal and external Information Security professionals, all of which are provided with relevant training and are required to maintain industry accredited certifications. Our Incident Response Team is chaired by our CISO and is comprised of executive management and designated managers throughout the organization. The purpose of the Incident Response Plan is to manage Information Security, and related incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, and notify customers, as required by state law, comply with regulatory requirements, and any third-party contractual obligations.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, including legal counsel, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.

companyName: Poseida Therapeutics, Inc.


text: As part of our efforts to facilitate effective oversight, the Cybersecurity Governance Committee and the Cybersecurity Risk Committee hold discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures at least quarterly and more frequently as necessitated by emerging material cyber risks or incidents.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices. We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements. For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our controls to prevent a cybersecurity attack.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Overall Risk Management We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have adopted the standard 2FA (two factor authentication)

companyName: Strive, Inc.

ticker: ASST


text: Management Oversight Our CISO is accountable for managing our enterprise information security department and overseeing our information security program. The CISO reports directly to the Chief Risk Officer. The CISO's responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The CISO has over 20 years of experience in cybersecurity across the U.S Government, Department of Defense contracting, and financial services industry. Prior to joining the Company, the CISO served as the Deputy CISO for a major domestic financial services institution. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to senior leadership and the Risk Committee and/or the Board in a timely manner.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: As a component of its general oversight over key risks to our business, our Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats. As a technology-enabled Medicare Advantage platform, we have selected directors with backgrounds in technology and expertise in data privacy and cybersecurity matters, which represent important elements of our risk management strategy.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: As part of management oversight, our CEO receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident's characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.

companyName: INTUIT INC.

ticker: INTU


text: The Company is exposed to diverse cybersecurity risks that have the potential to significantly impact our business operations, financial standing, and reputation. We seek to identify, assess, and manage these risks, with the aim of safeguarding our critical systems and information, and employ a documented process to respond in the event of a cybersecurity incident. This approach includes regular evaluations of our information systems and infrastructure to identify vulnerabilities and potential weaknesses through the use of system monitoring tools, as well as monitoring industry trends, threat intelligence, and emerging risks to anticipate and proactively assess potential threats. We engage third-party cybersecurity experts to conduct penetration testing, vulnerability scans, and risk assessments, informed by the NIST (National Institute of Standards and Technology) Cybersecurity Framework guidelines or ISO (International Organization for Standardization) 27001 standard, to increase the likelihood that system risks are identified.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: Aligned with our risk management governance structure, our management team oversees the daily management of cybersecurity risk, while our Board and its Audit Committee maintain an active and ongoing oversight role, with the Audit Committee receiving regular reports from management regarding cybersecurity risks and countermeasures being undertaken or considered, including updates to the internal and external cybersecurity landscape and relevant technical developments.

companyName: Whitestone REIT

ticker: WSR


text: Technical Safeguards As part of our Cybersecurity Program, we deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Our board of directors oversees risk directly and through its committees. Our audit committee is responsible for oversight of our policies and practices with respect to risk assessment and risk management including our cybersecurity and ERM programs. At each regular meeting of the audit committee of our board of directors, our Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer and Chief Ethics and Compliance Officer each report on risks, controls, and risk mitigation actions to address existing and emerging cybersecurity and data risks, any incidents, and progress against the Company's cybersecurity strategic roadmap. The audit committee provides guidance and feedback to management on areas of focus to continuously improve the programs and to mitigate our evolving risks. Our audit committee chairman reports on these discussions and other matters to our board of directors on a quarterly basis.

companyName: Dun & Bradstreet Holdings, Inc.


text: We rely on our technology infrastructure and information systems to perform operational activities as well as to maintain the Trust's business records and financial data. Our internally developed system and processes, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: Board's Roles and Responsibilities We have a Technology and Innovation Security Committee, comprised of six board members, with relevant backgrounds and experience, that oversees and advises the Board and management on matters involving the Company's overall strategic direction and significant business risks and opportunities in the areas of technology and information security.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: The Company's IT systems have been, and likely will continue to be, the target of computer viruses, cyberattacks, phishing attacks, and other malicious activity. While the Company has not experienced a known material breach to date, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that the Company will not suffer additional attacks or incur serious financial consequences or expense in the future. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of our internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.

companyName: EACO CORP

ticker: EACO


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section entitled " Risk Factors — If our electronic data is compromised, or we experience a failure in our information technology or storage systems, our business could be significantly harmed. " included within this Annual Report.

companyName: Expion360 Inc.

ticker: XPON


text: Our Cybersecurity Team assesses cybersecurity risks, including those related to our supply chain and third-party service providers that have access to our systems or facilities where JAKKS' data is stored. The team assesses how cybersecurity risks affect or are reasonably likely to materially affect the Company, including our operations or financial position. Our Cybersecurity Team is responsible for the Company's risk assessment, risk management, disaster recovery, and auditing of JAKKS overall cybersecurity program. The Cybersecurity Team meets with the Cybersecurity Subcommittee of the Board of Directors to discuss, identify, and address cybersecurity risks and review updates to our risk management program to ensure cybersecurity risks to the organization are mitigated. For further discussion of the risks associated with cybersecurity incidents, see In December 2022, the Company learned of a cybersecurity threat to its information technology system ("IT System"), and that certain data, including personal data of employees, had been extracted from the Company's IT System. Upon learning of the cybersecurity threat, the Company launched an investigation and undertook prompt action, including employing containment protocols to mitigate the impact of the threat, engaging third-party information technology cyber security and forensics experts and special legal counsel, and utilizing additional security measures to help safeguard the integrity of its IT System's infrastructure and the data contained therein. The Company has not identified any material damage suffered from the incident.

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents and (3) containing, eradicating, recovering from and reporting cybersecurity events.

companyName: W. P. Carey Inc.

ticker: WPC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetrating testing firms, dark web monitoring services, forensic investigators and DHS CISA monitoring service providers.

companyName: Enovix Corp

ticker: ENVX


text: Digital security at Microchip is the primary responsibility of our ITSS team. Our ITSS team is responsible for infrastructure services and business continuity as it relates to digital information. The ITSS team oversees compliance with our cybersecurity framework within our Company and facilitates cybersecurity risk management activities. The ITSS team also assists with the review and approval of policies, completes benchmarking against applicable standards and oversees the security awareness training program. ITSS works to address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. Collectively, ITSS has decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity and architecture training for our team members.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Our internal audit team assesses the effectiveness of our internal controls relating to cybersecurity. Our management team also engages, at times when needed, certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks, as well as to advise on specific topics. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security have various processes and procedures in place to evaluate cybersecurity threats associated with third parties. We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, performance, results of our operations, or financial condition.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity risk management and strategy processes are coordinated by our Director of Technology. He maintains the Certified Information Systems Security Professional certification and has nine years of senior leadership experience in defensive cyber security in both the private sector and Department of Defense. He is supported by leaders from our Information Technology, Document Management and Compliance teams, as well as management's Disclosure Committee who have extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. They draw on their knowledge of daily information technology operations, ongoing cybersecurity initiatives and various monitoring tools to ultimately report through the Director of Technology and Director of Internal Controls to the Audit Committee on the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents. In the event the Audit Committee determines that a cybersecurity incident has occurred, the Audit Committee will evaluate whether to escalate the cybersecurity incident to the full Board.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: As a Company, we have developed key security services, including data governance, encryption, vulnerability management, systems and network monitoring, access controls, application security, threat detection, incident response, employee awareness training, and assessment of our third-party service providers. We regularly test our incident response readiness and reporting through tabletop exercises, external and internal penetration testing and internal security testing so that identified risks and incidents are escalated and communicated for appropriate remediation activities that are intended to reduce risks to an acceptable level.

companyName: RADIAN GROUP INC

ticker: RDN


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, or cash flows.

companyName: Venture Lending & Leasing IX, Inc.


text: Our information systems have been subject to cybersecurity incidents in the past. To date, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect us. However, there is no guarantee that future cybersecurity incidents will not have a material impact. Despite our comprehensive approach to cybersecurity, we may not be able to prevent or mitigate a cybersecurity incident that could materially impact our business, results of operations, or financial condition. While we hold cybersecurity insurance, the expenses associated with cybersecurity threats or disruptions may not be completely covered by our policy. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.

companyName: Cencora, Inc.

ticker: COR


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See the risk factor, entitled "We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business" in Item 1A - Risk Factors.

companyName: Matterport, Inc./DE


text: At the management level, oversight of risks from cybersecurity threats has been integrated into the Company's overall risk management processes. The Senior Risk Council has broad oversight of the Company's risk management processes, and is also responsible for the assessment and management of risks from cybersecurity threats. The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer; Chief Financial Officer; General Counsel; Treasurer; and CIO, as well as other senior business leaders. The Company believes the experience that Senior Risk Council members have from serving on the Senior Risk Council provides them with an understanding of the Company's risk management process overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business. The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management. The CIO also holds a bachelor's degree in computer science. The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks. The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Board of Directors Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, employees and shareholders. In line with its broader strategic oversight, the Board oversees cybersecurity, including strategy and processes. To assist with oversight of cybersecurity, the Board has delegated to the Audit Committee responsibility to oversee certain aspects of cybersecurity, including controls and reporting. As part of its independent oversight of the key risks facing the Company, the Board and Audit Committee devote considerable time and attention to the oversight of management's approach to cybersecurity and related risk mitigation, including strategy, controls. resources, policies, standards, processes and practices. At least semi-annually, the Audit Committee or full Board receive reports from the CIO and CISO. Such reports include updates on the Company's cybersecurity risk profile, assessments of the Company's enterprise and product security programs, management's strategy for managing risks, measures implemented to identify and mitigate cybersecurity risks, the status of projects to strengthen the Company's cybersecurity posture, the emerging cybersecurity threat landscape, and other relevant topics. We have protocols and processes by which certain cybersecurity incidents, as specified by our Cybersecurity Incident Response Plan, are escalated within the Company and, as appropriate, to the Audit Committee. These escalation protocols are periodically reviewed and updated, as needed.

companyName: Xylem Inc.

ticker: XYL


text: Our Chief Executive Officer works to manage our cybersecurity policies and processes. He is responsible for managing how we identify, address, prevent and resolve cybersecurity issues and related matters. He is also responsible for tracking how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receives periodic updates on cybersecurity and information technology matters and related risk exposures from management.

companyName: XCel Brands, Inc.

ticker: XELB


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. Our information systems manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.

companyName: VPR Brands, LP.

ticker: VPRB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, who has over 10 years of information technology management experience.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Company's Board of Directors has specific oversight responsibilities related to cybersecurity, including review of security controls and incident response plans. Management provides updates to the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity of the date of this filing, we have no t experienced any material cybersecurity incidents that have materially impacted our operations, financial condition, or results of operations.

companyName: Verses AI Inc.

ticker: VRSSF


text: Our cybersecurity risk management risk assessments to identify material cybersecurity risks to our Confidential Information, Critical Systems and broader enterprise IT environment;

companyName: Hour Loop, Inc

ticker: HOUR


text: For a discussion on certain of the Company's cybersecurity-related risks, see Item 1A under the heading "Risk Factors-Risks Associated with Our Operations - A cybersecurity incident and other technology disruptions could negatively impact our business. "

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: We are committed to safeguarding our customers' information that is shared with us in the application of the software and services we contractually provide to them. Our information systems, including our cybersecurity program, risk management systems and processes and governance, reflect our dedication to meeting industry cybersecurity standards.

companyName: Certara, Inc.

ticker: CERT


text: Our security and legal teams actively participate in industry and other advisory groups and monitor regulatory requirements to keep apprised of evolving risks. Policies and procedures, including our Written Information Security Policy, are periodically updated to adapt to evolving business conditions and information technology requirements.

companyName: HUBSPOT INC

ticker: HUBS


text: We currently use a third-party sub-contractor to manage Information Technology (IT) issues, including with respect to protection against, detection, and response to cyberattacks but have not adopted an Information Technology Policy as a result of our size and the status of our operations.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: The foundation of our Cybersecurity Program is based on recognized best practices and standards for cybersecurity and information technology that include the Center of Internet Security ("CIS") Controls Framework. The CIS Critical Security Controls Framework is a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are mapped to and referenced by multiple legal, regulatory, and policy frameworks. This framework is employed to guide cybersecurity investments similar to third party audits and risk assessments. Our Cybersecurity Program employs a practical risk-based approach with a focus on addressing risk factors with the highest possible impact, high levels of likelihood, and least amount of existing compensating controls. Key risk factors, along with action plans and a status of identified matters are communicated to Executive Management, the Audit Committee and the Board as part of the CISO's quarterly updates. We have created and continually update, as required, a detailed cybersecurity incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification and which we will implement in the event of a cybersecurity incident, including the determination of materiality of cybersecurity incidents to ensure accurate and timely disclosures of those events in accordance with current regulatory requirements.

companyName: International Money Express, Inc.

ticker: IMXI


text: Assessing, Identifying, and Managing Material Risks Trinity's IRM program is aligned to the National Institute of Science and Technology ("NIST") Cybersecurity Framework ("CSF") and conducts maturity assessments against the NIST CSF on a quarterly basis. Our IRM program encompasses the full lifecycle of information risk, from creation through disposition, and is guided by policies, processes, standards, and procedures in vulnerability management, incident response, information governance, risk management, and security awareness. Additionally, Trinity exercises a variety of testing approaches to assess the state of systems and personnel, including annual penetration testing by independent third parties, ad hoc penetration testing by internal personnel, and tabletop exercises for executive and senior leadership, information technology, IRM, and legal employees. Trinity also maintains an incident response relationship with an industry-leading provider to ensure resource availability if a significant event were to occur.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our head of Information Technology evaluates material risks from cybersecurity threats and reports periodically to our Audit Committee, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers such as Crowdstrike, cybersecurity service providers such as Mimecast, penetration testing firms, auditors, and professional services firms, including legal counsel. These relationships enable us to leverage specialized knowledge and insights, enabling our cybersecurity strategies and processes to remain consistent with industry best practices.

companyName: GERON CORP

ticker: GERN


text: We have established a cybersecurity program, informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), that is designed to safeguard our information systems against cybersecurity threats. This program incorporates a variety of processes and cybersecurity tools designed to assess, identify and manage material risks from cybersecurity threats.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: Our cybersecurity risk management program shall include: assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity awareness and spear-phishing resistance training of our employees, and senior management;

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: The full Board of Directors retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, our Board of Directors receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.

companyName: GULF RESOURCES, INC.

ticker: GURE


text: We have processes to assess, identify and manage risks from cybersecurity threats as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. We engage certain external advisors to enhance our cybersecurity oversight.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company, in coordination with the Investment Adviser's risk management, legal, information technology, and compliance teams, conducts ongoing due diligence on third-party service providers (including contractual provisions and regular compliance attestations) to ensure they meet requisite cybersecurity standards. For critical vendors, the Company requires SOC 2 Type II reports or similar independent cybersecurity assessments. In lieu of these reports, vendors may provide compensating materials demonstrating the structure and management of their cybersecurity programs.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Chief Information Officer, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Chief Information Officer, other members of management, the Committee, and the Board, each as needed.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our Chief Operating Officer and other members of senior management provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Operating Officer provides annual briefings to the board of directors on cybersecurity risks and activities.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: Our current CISO maintains appropriate security certifications and has over 20 years of experience in an information security role. The CISO manages a group dedicated to the security of the bank. This group is responsible for information technology monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO. Our CISO reports directly to our COO and oversees, is assigned the responsibly of and is held accountable for the implementation and monitoring of the Program. Our COO serves on the Risk Committee of the Board, chaired by a board director.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: As part of its regular oversight role, our Board of Directors, with a primary focus on policy, oversight and strategic direction, oversees management's development and maintenance of the enterprise cybersecurity program and its actions to identify, assess, mitigate and remediate cybersecurity threats to our Company. Our Board of Directors has delegated to its Audit Committee (the Audit Committee) primary responsibility for regular oversight of cybersecurity risk at the Board-level and this delegation is reflected in the Audit Committee's Charter. Our Chief Information Officer provides a regular quarterly report to the Audit Committee regarding cybersecurity matters and our enterprise cybersecurity program.

companyName: EQT Corp

ticker: EQT


text: Our cybersecurity risk management program ("cybersecurity program") is designed and assessed by leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), customized to align with our entity size, risk profile, and industry best practices. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program is an integral part of our broader Enterprise Risk Management (ERM) framework and business continuity efforts. By incorporating cybersecurity into our overall risk assessment and management processes, we aim to address interconnected risks that could impact critical operations, systems, and assets. This alignment allows us to proactively evaluate and prioritize cybersecurity risks in the context of broader organizational objectives and resilience planning, ensuring a comprehensive approach to safeguarding the Company's infrastructure and stakeholders.

companyName: BTCS Inc.

ticker: BTCS


text: Cybersecurity Risks As of December 31, 2023, we have not had any material incidences involving cybersecurity attacks. However, we face risks associated with security breaches, whether through cyber-attacks or cyber-intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, or other scams. Although we make efforts to maintain the security and integrity of our networks and systems including the proprietary, confidential, and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "We and our tenants face risks relating to cybersecurity attacks that could cause the loss of confidential information or other business disruptions" in Item 1A. "Risk Factors" for further information relating to cybersecurity risks.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: •"—Cybersecurity attacks or threats or other unauthorized access or attempts to access to our systems, or those of third parties, have in the past, and may in the future, compromise the security of our systems and otherwise disrupt our normal operations, which could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows," and •"—Our independent, third-party authorized dealers may not be able to mitigate certain risks such as information technology and data security breaches, product liability, errors and omissions, and compliance with applicable laws and regulations."

companyName: ADT Inc.

ticker: ADT


text: Conduct regular phishing email simulations for all employees; and cybersecurity risk insurance that protects against the potential losses from a cybersecurity incident.

companyName: CVD EQUIPMENT CORP

ticker: CVV


text: Endpoint and Device Protection & Anti-Malware – The Company has hardening policies and processes and uses a "gold image" approach to deploying new clients and servers. Configurations that go into gold images are reviewed with security staff. Advanced anti-malware controls are in place and patching cadence and performance of endpoint devices are watched closely. Cincinnati Bell Inc.

companyName: CINCINNATI BELL INC


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business are identified and addressed through a multi-faceted approach that consists of third-party assessments, testing of our information systems and information technology security. To defend against, detect and respond to cybersecurity incidents, we, among other things: have enabled regular monitoring of our environment by a combination of external partners and internal security tools, conduct regular employee trainings, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: uniQure N.V.

ticker: QURE


text: Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions and has extensive experience as a chief financial officer, chief operating officer and special projects lead, with expertise in accounting, taxation, business advisory, business risks identification and management and business systems designs across many industries, including the application of IFRS and US GAAP for the life science industry.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: We provide regular, mandatory security awareness training for personnel to educate our employees on cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices. In addition to the training, we periodically test employees with phishing emails.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including but not limited to IT policies (incident management plan, stake-holder engagement, incident response plan, DR plan, etc.) incident detection and response, and vulnerability detection and management, preventative controls including firewalls, secure coding practices and IDS, annual disaster recovery testing, data segregation and encryption (at rest and in-transit), network security controls and access controls, asset management, tracking and disposal, vendor management, employee training and awareness and cybersecurity insurance.

companyName: Moatable, Inc.

ticker: MTBLY


text: Our current cybersecurity management strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic cybersecurity testing. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted internally and with our IT consultants and service providers, as needed. We have recently begun reporting on cybersecurity in reports to the Board of Directors and will continue to do so.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: When a company purchases our service offerings, they gain a trusted digital advisor who will work together with them in their efforts to protect their data. We aim to provide a secure and compliant enterprise cloud platform and we work to build trust and in-depth defense into all of our systems. Among other things, we employ an experienced team of cybersecurity professionals, engage in community events and offer free online cybersecurity incident prevention training to help enable our customers to focus on their business, knowing their data is safe and accessible as needed.

companyName: Salesforce, Inc.

ticker: CRM


text: In an effort to deter and detect cyber threats, we provide a monthly cybersecurity awareness newsletter to all employees, including part-time and temporary contractors, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The cybersecurity training and awareness programs function to remind employees of the importance of reporting all incidents quickly. We run frequent phishing tests to raise awareness of spam emails, the primary attack vectors for cyber threats and to further raise awareness of cyber threats. We provide annual training on employee responsibilities for protecting company information and data along with our overall compliance responsibility. Each October during cybersecurity awareness month in the U.S., we provide weekly updates on cybersecurity awareness and host a company-wide lunch and learn discussion of our cybersecurity program and the impact of cybersecurity on individuals as well as the company, with a data protection, cybersecurity and incident response and prevention training and compliance program.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: The Board oversees the management of risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity, which address a wide range of topics and also receives prompt and timely information regarding any cybersecurity incident that is or may become material, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Senior Director of Cyber Securit y, who is the member of management that is principally responsible for overseeing cybersecurity at the Company, in partnership with other business leaders across the Company, including our Chief Executive Officer, Chief Accounting Officer, General Counsel, and Human Resources leader. Our Senior Director of Cyber Security has served in various roles in information technology and information security for over 20 years, including serving as Information Security Officer for a global medical device manufacturer. He holds degrees in Global Business Management and Computer Science.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents; however, NACCO cannot provide assurance that we will not be materially impacted in the future by such risks or any future material incidents. For additional information regarding our cybersecurity risks, please refer to Item 1A - Risk Factors on page 18.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: The identification of cybersecurity risks is a continuous and evolving assessment. As a data company, we are subject to cybersecurity risks. We have identified certain cybersecurity risks specific to our business, which are identified above in Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.

companyName: Vigil Neuroscience, Inc.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: As one of the critical elements of the Company's overall risk management approach, the Company's cybersecurity program is focused on the following key areas:

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Our information security program encompasses policies and controls aimed at mitigating cybersecurity risks. However, we acknowledge the presence of both known and unknown risks, alongside vulnerabilities within our security program. Continuous improvement efforts are integral to enhancing our information security program and overall risk management endeavors.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: On at least a quarterly basis, Tyler's CISO provides a formal report to the Audit Committee and to the Board of Directors. Our Audit Committee Chair and CISO also communicate on an as-needed basis between those quarterly reports. In 2022, Tyler's Lead Independent Director completed the requirements to receive the CERT Certificate in Cybersecurity Oversight from the Software Engineering Institute at Carnegie Mellon University. Another Tyler director possesses more than 38 years of Department of Defense experience in cyberspace operations and major computer network architectures.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Our Innovation and Technology ("I&T") Committee of the Board is responsible for the oversight of risks from cybersecurity threats. All of our Board members are members of the I&T Committee. At least quarterly, management provides the I&T Committee with updates regarding our cybersecurity risks, threats, and efforts focused on mitigating those risks. These updates are provided by our Chief Digital Officer ("CDO") and our CISO, and include recent developments in cybersecurity, the company's actual experience with cybersecurity incidents, and the systems and processes in place to defend against cyberattacks. Should a material or potentially material cybersecurity incident occur, the Board will immediately be notified of such event by the company's CEO. Our CDO and CISO frequently communicate with affected business and finance leaders regarding any cybersecurity related event.

companyName: TrueBlue, Inc.

ticker: TBI


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks.

companyName: Netcapital Inc.

ticker: NCPL


text: The Board of Directors has delegated primary oversight of the Company's cybersecurity risk to the Audit Committee, which receives updates on cybersecurity risks, risk mitigation initiatives, and incidents at each regularly scheduled Audit Committee meeting from the CIO, CISO, and other members of management, as needed. When making decisions regarding director appointments and committee assignments, the Board of Directors takes into consideration the cybersecurity experience of directors and director candidates and strives to maintain cybersecurity expertise on the Board of Directors and Audit Committee. We have protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board of Directors.

companyName: UNION PACIFIC CORP

ticker: UNP


text: In 2023, we established a management executive committee that consists of our CISO, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer that is responsible for determining if a cybersecurity incident is material to the Company and requires disclosure. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: In the event of a cybersecurity incident, our incident response team, composed of members of our information security team as well as other key personnel, identifies, evaluates, and quantifies the relevant risks based on the available information and classifies the severity of the cybersecurity incident based on the level of risk to the Company. Our incident response measures include procedures to provide incident updates and developments to our senior management and the Board of Directors in the event of an ongoing cybersecurity incident. We also maintain an information security risk insurance policy. We conduct internal exercises to prepare our leadership and cross-functional teams to respond in the event of a cybersecurity incident and to help us test and consider revisions to our incident response procedures. We also actively engage with key consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Board of Directors. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect the Company.

companyName: XPO, Inc.

ticker: XPO


text: Our Chief Information Security Officer (CISO) is responsible for developing and implementing our cybersecurity risk management and information security program, including regularly reporting on cybersecurity matters to management and the Audit and Finance Committee. He has a Bachelor of Science degree in Information Technology from Saint Mary's University of Minnesota and over 25 years of experience covering a wide range of enterprise IT and Information Security programs for large, global corporations. He also has multiple industry certifications, including as a Certified Information Systems Security Professional (CISSP), and participates in various security leadership forums and committees. Our CISO has led our cybersecurity program since joining our company in 2018, and was recently promoted to CISO from Senior Director, Information Security.

companyName: PATTERSON COMPANIES, INC.


text: Our product cybersecurity focus begins with our design protocols and is supported by quality testing, provider education, and packaging and distribution standards. We use penetration testing to simulate cyberattacks and better understand our exploitable weaknesses, and we monitor threat intelligence feeds, including avenues for product users to report vulnerabilities directly to us, and use scanning tools to detect and assess vulnerabilities that could affect our products. In addition, we conduct product, enterprise and vendor/third party risk assessments, vulnerability assessments and analyses to gain insights into potential vulnerabilities and their impact on critical functions, and leverage their outcomes to prioritize our security investments and balance our resource allocation.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Daniel Chartock, our Chief Growth Officer and Executive Vice President of Operations, is responsible for assessing and managing cybersecurity risks. Mr. Chartock is experienced in assessing and managing cybersecurity risks due to his 30+ years in information technology consulting.

companyName: GeoSolar Technologies, Inc.


text: IT leadership, along with Internal Audit and our Legal teams, receive reports on present cybersecurity threats from a number of experienced information security specialists or other relevant parties responsible for various parts of the business on an ongoing basis. Management, including the Vice President of Information Technology and Security and Chief Information Officer, reports quarterly, or more frequently if needed, to the Board of Directors, including the Audit Committee, on the effectiveness of our cybersecurity and data protection practices. The Audit Committee reviews the findings of the Company's annual risk assessment and penetration test. Further, our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: The Bank's Technology and Operations Committee is made up of members of the Bank's leadership, including the Bank's CIO, CISO, other information technology and information security leadership, and leadership representatives from the Bank's operational risk, information security, information technology, operations, and other departments throughout the Bank.

companyName: Federal Home Loan Bank of New York


text: o The team implements and maintains a multi-layered defense approach to safeguard the Company's information technology infrastructure in accordance with industry best practices and updates the Company's systems and software to address identified vulnerabilities. The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.

companyName: IMAX CORP

ticker: IMAX


text: In addition, at regular meetings of the Board, the Board members, including the CEO, and the CLCO and COO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board members actively participate in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Board of Directors conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: We use third-party providers to perform various functions throughout our business, such as application providers and hosting companies. We use third-party providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, and forensic investigators. The Company maintains a risk-based approach and process designed to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could materially impact our business if there is a cybersecurity incident affecting those third-party systems.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Regular assessments of our cybersecurity through both internal evaluations and planned periodical third-party audits, ensuring adherence to the highest standards of security.

companyName: QHSLab, Inc.

ticker: USAQ


text: Cybersecurity: Governance Our Board of Directors considers cybersecurity risk within the Board's risk oversight function. The board of directors has charged management with responsibility for oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. The Board oversees management's implementation of our cybersecurity risk management program.

companyName: Maitong Sunshine Cultural Development Co., Ltd

ticker: MGSD


text: The VP of MIS has expertise assessing and managing cybersecurity risks, and is a member of both the Risk Committee and Cybersecurity Committee. He has served in his current role since 2014 and has held several senior-level information technology roles in his 31-year tenure with the Company. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT