text: Key features of our cybersecurity risk management program include • A dedicated team of risk analysts who manage the program and associated activities, such as risk assessments, risk lifecycle management, control assessments, and risk reporting. • Risk assessments that are conducted by the risk team on a regular basis, which sometimes include emerging topics addressed through targeted risk assessments. • Security incident response policies and procedures to investigate and respond to security incidents, including procedures to assess the threat of relevant vulnerabilities or security incidents, and to establish remediation and mitigation actions for events. • Security awareness training campaigns assigned to our users at least twice a year covering a multitude of security and privacy topics. • Management of third-party risk, including conducting cybersecurity assessments of vendors before onboarding them, followed by ongoing monitoring for compliance with standards.

companyName: SailPoint, Inc.

ticker: SAIL


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our CISO. The CISO experience includes prior leadership roles within the Company, where they developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The CIO and CISO oversee our governance programs, work with our technology-focused leaders and partners to align security and compliance, and has developed our employee security awareness training program.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC

secItem: Item 1C


text: Board Oversight of Risks from Cybersecurity Threats: The Board is ultimately responsible for the oversight of risks from cybersecurity threats and collaborates with the Audit Committee of the Board and the ERC in these oversight responsibilities. The responsibilities of the ERC include participating and collaboration with the CROC to oversee policies and management systems for cybersecurity matters, overseeing the identification, assessment and response to cybersecurity risks, maintaining and implementing our IRP, and communicating on a regular interval, or more frequently (if necessary) with the Board, the Audit Committee and executive management in regard to such risks. The Company's processes call for prompt and timely notifications and updates to the Board and the Audit Committee, as applicable and as necessary depending on the nature and severity of the incident, in connection with any cybersecurity incidents that may occur. In addition, the Board, the Audit Committee, and the ERC receive regular presentations and reports on cybersecurity matters that address the full range of cybersecurity topics discussed herein. Further, on a periodic basis, the Board and/or Audit Committee and the ERC also discuss our cybersecurity programs and processes with our CEO, Chief Information Officer ("CIO"), and Chief Information Security Officer ("CISO").

companyName: Vertiv Holdings Co

ticker: VRT


text: The Audit Committee of our Board of Directors oversees and reviews the Company's cybersecurity risks and the steps management has taken to protect against threats to the Company's information systems and security. The senior leadership team, including our Executive Director and Chief Executive Officer, provides periodic reports to our Board and the Audit Committee, as applicable.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: We have established various policies, processes, and technologies to aid in our efforts to assess, identify, manage, and mitigate material risks posed by cybersecurity threats, including, among other things: • Our CISO and IT teams continuously monitor our systems and perform an annual cybersecurity risk assessment; • We have implemented a proactive incident response and management plan generally aligned with the National Institute of Standards and Technology (NIST), with annual plan testing and training for employees involved in the response process; • Annual penetration tests are performed by a third party and any notable findings are included in remediation plans; • We engage with key industry partners and threat intelligence services, including assessors, consultants and other industry third parties to evaluate our cybersecurity risk management and incident response plans and processes; • All employees, contractors and temporary workers are required to review and acknowledge our acceptable use policies, which include sections on information and cybersecurity practices and policies; • Employees are regularly engaged in cybersecurity awareness campaigns, anti-phishing tests, and mandatory training as needed; • We address third-party cybersecurity risks through interviews and third-party independent assessment reports; • We maintain cybersecurity insurance coverage as part of our overall insurance portfolio; and • In conformity with customer requirements, we require proof that subcontractors complete relevant cybersecurity education and awareness training prior to being awarded a subcontract.

companyName: TUTOR PERINI CORP

ticker: TPC


text: We are continuously working to ensure that we satisfy generally applicable industry standards for the assessment, identification, and management of risks from cybersecurity threats that may pose a risk to our information technology systems, including from third parties with whom we work with.

companyName: Viewbix Inc.

ticker: VBIX


text: management and strategy have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: GENELUX Corp

ticker: GNLX


text: While cybersecurity threats remain a risk to the Company's business operations, our risk mitigation strategies have been effective. Accordingly, no such threats have materially affected our business strategy, results of operations or our financial condition. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see We rely heavily on information technology systems that, if not properly functioning, could materially adversely affect our business in Item 1A, Risk Factors.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: The Company's Chief Financial Officer and Treasurer, Chief Legal Officer and Secretary, and Head of IT work collaboratively with other employees of our Manager or its affiliates and the MSSP to ensure the MSSP's services protect the Company's Information Systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. These members of the Company's management team, together with the MSSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit and Valuation Committee when appropriate. These members of the Company's management team meet periodically to assess cybersecurity risks and discuss with the Audit and Valuation Committee. They have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, through their roles at the Company or other organizations.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.

companyName: Vivani Medical, Inc.

ticker: VANI


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors has delegated to the Audit Committee to be actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are in the process of being fully integrated into our ERM program and are based on recognized frameworks and applicable industry standards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information systems that we use and the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vizio Holding Corp.


text: Engaging Third Parties Companies, especially in the technology industry, have been subject to an increasing number of complex cybersecurity risks. Infinera has engaged with a range of external service providers, including consultants, auditors, and cybersecurity service providers, to help Infinera understand, manage, and mitigate cybersecurity risks. These engagements help Infinera drive improvements in its processes, identify new and emerging threats, and respond rapidly to the ever-evolving cybersecurity risk landscape.

companyName: Infinera Corp


text: We define information security and cybersecurity risk as the risk that the confidentiality, integrity, or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification, or destruction. Information security and cybersecurity risk is an operational risk that is measured and managed as part of our operational risk framework. Operational risk is incorporated into our comprehensive Enterprise Risk Management ("ERM") program, which we use to identify, aggregate, monitor, report, and manage risks.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: We have developed and implemented cybersecurity risk management practices intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management practices include a cybersecurity incident response plan.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: Management's Role in Cybersecurity Risk Management We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. The current CISO has 15+ years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training and incident response. The CISO's credentials include a Master of Science Degree in Information Security Management from SANS Technology Institute and a CISO Certificate from Carnegie Mellon University. The CISO holds multiple certifications including CISSP, CISA, GCIH, GCIA and PMP. Pursuant to our formal CIRP, suspected cybersecurity incidents are first evaluated by the Carpenter Technology Cybersecurity Team Leader who follows the guidance as outlined in the CIRP to respond to cybersecurity incidents and escalate as necessary based on a defined severity matrix. Based on the nature and severity of the incident, the response team may be comprised of representatives from our Information Technology, Human Resources, Safety, Legal, Finance and Communications departments, who jointly determine if the incident may result in a business interruption, require reporting to regulators, employees and/or business partners, have a material financial impact or cause reputational harm and should be escalated to the executive crisis response team, which includes Chief Executive Officer, Chief Financial Officer and General Counsel. For all matters that have been escalated, the responsible team executes specified procedures to contain the incident, implement incident response procedures and implement and document remediation measures.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: Our technology structures undergo an annual assessment to evaluate risk using the NIST Cybersecurity Framework. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.

companyName: JACK IN THE BOX INC

ticker: JACK


text: We conduct security assessments, manage user access, perform vulnerability scanning and patching, oversee monitoring and carry out annual penetration testing, in addition to other critical security functions. In conjunction with our internal team, we utilize an independent third-party operations center that is focused on, but not limited to, monitoring alerts, logs, behavior analytics, vulnerability notifications and remediation guidance. Critical infrastructure is continuously monitored to ensure accessibility and appropriate security posture. We also perform reviews and risk analysis for third-party software and platforms which sets a standardized security baseline. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors, allowing us to increase security of our technology assets and our data. In addition, we perform an annual cybersecurity risk assessment of critical third-party systems.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: penetration and vulnerability testing, simulations, and other exercises designed to evaluate the effectiveness of our information security processes and improve our security measures.

companyName: LUMOS PHARMA, INC.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Company relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's Cybersecurity Program. The Company depends on and engages various third parties, including service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its reliance upon such third parties.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: We have established a cross-functional Cybersecurity Steering Committee, comprised of our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other senior management. The Cybersecurity Steering Committee is charged with overseeing the management of our enterprise security program, including reviewing and prioritizing cybersecurity risks, monitoring potential incidents, establishing key mitigation initiatives, overseeing cybersecurity governance and promoting and supporting cybersecurity best practices. The Cybersecurity Steering Committee is chaired by our CISO, who reports to our CIO. Both our CISO and our CIO have extensive experience in assessing and managing cybersecurity programs and risk management through serving in various senior roles in information technology and cybersecurity, serving on external Boards of Directors and holding multiple industry-recognized certifications.

companyName: ANALOG DEVICES INC

ticker: ADI


text: Our cybersecurity program is overseen by the Company's CTO in close collaboration with the CEO/Chairman of the Board of Directors and our legal and compliance teams. Both our CEO and our CTO have technical backgrounds and are well informed about cybersecurity risk management best practices, as well as our Company's risk management framework. Our legal and compliance teams supporting the Company's cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.

companyName: Spire Global, Inc.

ticker: SPIR


text: The VP of Information Technology and DCSDP also have a reporting responsibility to the General Counsel, and the Board via the Audit Committee. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board, the Audit Committee, and other stakeholders on a quarterly basis, or more frequently as needed.

companyName: Certara, Inc.

ticker: CERT


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We have implemented a risk-based approach to identify and assess cybersecurity threats that could impact our business and information systems. As part of this strategy, the Company has engaged a third-party service provider to implement comprehensive IT and cybersecurity policies, including Guardz, Cyber Essentials, and others. These initiatives are supported by detailed policies, staff training programs, and the use of advanced tools such as firewalls and VPNs to prevent cybersecurity incidents. Additionally, consultation with third-party experts has further strengthened the Company's IT framework and improved overall compliance. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: CDT Equity Inc.

ticker: CDT


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Operating Officer and Chief Information Officer, Chief Risk Officer, General Counsel, Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and IT. The SPPO is accountable to the VP of Information Technology, who is the accountable executive for the program. Our function and business unit executive leadership, acting in support of the SPPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our VP of Information Technology, has 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 15 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has 30 years in IT with the last 12 focused on compliance and data privacy issues for Certara.


text: On an operating level, our cybersecurity program is managed by a dedicated Chief Information Security Officer (CISO), reporting to our Chief Information Officer (CIO), who together lead a geographically dispersed team comprised of our employees, highly skilled contractors and other key functional third-party resources. Our CISO holds a Masters of MIS in Information Security and prior to joining Ribbon, served as the Director of Information Security & Privacy at Ericsson for the Americas. Prior to Ericsson, she held cybersecurity positions at Walgreens, Fortunes Brands Home & Security, and W.W. Granger. She is a Certified Information Security Manager, has operated her own security firm, and has over 20 years of cybersecurity experience, including her time as a US Navy Operations and Training Manager. Our CIO has held that position (or Head of IT) at Ribbon for over seven years. He has over 25 years of experience in the IT area including over nine years overseeing IT cybersecurity, cybersecurity roadmaps and IT general controls. During his career he has overseen initial ISO 27001 certifications, as well as the implementation of over 30 cybersecurity platforms. The CIO and CISO are part of our cybersecurity council, which also includes our CEO, CFO and other key leaders. The cybersecurity council meets monthly to review the cybersecurity metrics, new potential threats, and progress against the cybersecurity roadmap. Key matters from these monthly council meetings are presented to the Audit Committee.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: As of the date of this report, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation and cause damage to our relationships,, as well as prevent us from attracting new clients / customers. and / or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. We currently do not carry a cyber liability insurance policy, but are evaluating whether to acquire one to mitigate any financial impact of a cybersecurity breach.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: The Audit and Risk Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit and Risk Committee performs an annual review of the Company's cybersecurity program and the Company's overall risk assessment, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit and Risk Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives regular cybersecurity updates, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Business Continuity Plan, which covers, among other things, potential cybersecurity incidents, and potential impacts to data privacy and compliance. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, the Board has hosted an outside expert to discuss developments in the cybersecurity threat landscape.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: Service Providers operate our business, we utilize certain third-party service providers to perform a variety of functions. We intend to use the same outsourcing partners as much as possible for consistency. We are planning to establish selection and management policies in the future.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We work to align to the National Institute of Standards and Technology (NIST) 800-171 Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information system professionals and third-party providers monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.

companyName: BROADWIND, INC.

ticker: BWEN


text: Senior IT leaders are responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: STURM RUGER & CO INC

ticker: RGR


text: The Board provides oversight of management's efforts to assess and manage cybersecurity risks and respond to cybersecurity incidents and threats. In addition, the Audit Committee of the Board of Directors regularly receives reports from management regarding the Company's financial and compliance risks, including, but not limited to, risks relating to internal controls and cybersecurity risks.

companyName: MOODYS CORP /DE/

ticker: MCO


text: We have identified and analyzed the nature and scope of the affected systems and data. We have notified our affected customers and applicable state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers; are providing credit monitoring, web monitoring, and identity theft restoration services; and are fielding questions from customers. We are continuing to coordinate with law enforcement, our customers, regulators, advisors and other stakeholders. We have been named as a defendant in several lawsuits related to this incident. The Company will vigorously defend itself against any litigation filed related to this incident. At this time, we do not believe that the incident will have a material impact on the Company.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: As of March 31, 2025, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected Microchip, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "We continue to be the target of attacks on our IT systems. Interruptions in and unauthorized access to our IT systems, and security breaches or incidents impacting our systems or data that we or our service providers maintain or otherwise process, could adversely affect our business", in this Annual Report on Form 10-K.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our management and the Director of Information Technology of our Adviser.

companyName: VINEBROOK HOMES TRUST, INC.


text: Key elements of our cybersecurity program include the following: • The Board's oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department. • We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis. • We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: The Company's Information Security team coordinates with teams across the Company to prevent, respond to and manage security incidents, and engages third parties, as appropriate, to assess, test or otherwise assist with aspects of its security processes and incident response. A dedicated Supplier Trust team manages information security risks the Company is exposed to through its supplier relationships. The Company has processes to log, track, address, and escalate for further assessment and report, as appropriate, cybersecurity incidents across the Company and its suppliers to senior management and the Audit and Finance Committee (the "Audit Committee") of the Board. The Company's enterprise risk management program is designed to identify, assess, and monitor the Company's business risks, including financial, operational, compliance and reputational risks, and reflects management's assessment of cybersecurity risks.

companyName: Apple Inc.

ticker: AAPL


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes. The CISO, with over 30 years of technology experience, has been in this role with Wesco since 2020, has a total of eight years of experience serving in the role of Chief Information Security Officer, and has twelve years of experience dedicated to cybersecurity. The CISO reports to our Executive Vice President, Chief Information and Digital Officer ("CIDO"), who reports directly to our Chief Executive Officer. The CISO and CIDO regularly review cybersecurity matters with our Chief Executive Officer and other members of our senior management, including cybersecurity risks and threats and the status of our cybersecurity incident response plan and related processes relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. As part of its oversight responsibility of cybersecurity risk and the overall enterprise risk management process, the Audit Committee of our Board of Directors meets at least quarterly with our CISO, CIDO, and other senior leaders to receive updates on cybersecurity risks and threats (and should they arise, any material incidents), the status of initiatives to strengthen our information security systems, management's assessments of our security program, and compliance with disclosure requirements. The Audit Committee and senior management report any findings and recommendations, as appropriate to the full Board of Directors for consideration. Wesco's cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior leadership and the Board of Directors. We also actively engage with strategic partners, industry groups, and intelligence and law enforcement to better understand macro trends and significant risk concerns to better inform and enhance our cybersecurity policies and procedures.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Our Audit Committee is responsible for overseeing risks from cybersecurity threats. At each meeting of the Audit Committee, our CIO provides a report on cybersecurity matters. The Audit Committee's cybersecurity-related oversight includes the following: • Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; • Reviewing our cybersecurity threat landscape, risks and cybersecurity programs and policies; • Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; • Reviewing our technology and information systems strategies and trends that may affect these strategies; • Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs; • Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy; and • Reviewing and providing oversight on the Company's crisis preparedness with respect to cybersecurity. During the year ended December 31, 2024, our Audit Committee met four times.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Our Chief Security Officer ("CSO") reports to the Audit Committee periodically on significant cybersecurity incidents and risks, as well as progress made on cybersecurity roadmap initiatives. The CSO also presents to the Board at least annually to address the current threat landscape, our readiness to meet those threats, and cybersecurity priorities and focus areas for the upcoming fiscal year.

companyName: Aspen Technology, Inc.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management processes.

companyName: Enviva, LLC


text: We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our President and Chief Operating Officer with the responsibility of managing the cybersecurity risk assessment and mitigation process with the oversight of the Chief Financial Officer responsible for the consolidated financial statements for the year part of our overall risk management program, we provide cybersecurity training to employees in high risk areas and have distributed standard operating procedures to all employees. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors,"

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: Management has implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. The Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems, and enterprise data. The Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, contract management, training and awareness, auditing, compliance monitoring and testing, table-top exercises, and incident response.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor evolving cybersecurity standards and emerging data protection laws and implement changes to our processes to comply; • Conduct annual policy re-certifications for all employees regarding data protection, data breach reporting requirements and data classification; • Employ multifactor authentication on internal and external systems; • Conduct regular phishing email simulations for all employees; and • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practical through changes or updates to our internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as the cybersecurity risk assessment process and developed an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.

companyName: Banzai International, Inc.

ticker: BNZI


text: We have established a risk management framework which provides for the identification, assessment, management, and monitoring of cybersecurity risks. The implementation of this framework includes an iterative and periodically updated risk identification process and will include penetration testing. Identified risks are assessed, managed, monitored, and periodically reassessed to account for new threats, changes in operations, the effectiveness of implemented safeguards, and other factors.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our board of directors oversees our enterprise risk register and cybersecurity program, including related policies and procedures. As part of this oversight, the audit committee of our board of directors receives regular status reports and updates from our management team and conducts periodic executive sessions with our Chief Information Officer. Such status reports and executive sessions cover cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.

companyName: Transocean Ltd.

ticker: RIG


text: As part of management oversight, our Chief Executive Officer (CEO) receives monthly updates from the CISO and representatives from CyberCRAFT. These updates provide a recurring overview of cybersecurity trends and status updates (e.g., security events, fraud detection, IT roadmap progress, follow-up from prior assessments, security awareness exercise results), as well as a more focused analysis on select cybersecurity topics for the month. Examples of prior topics include: recent cybersecurity legislation, cybersecurity incidents affecting external entities, and trends in cybersecurity controls and adoption. As part of our incident response processes, incidents are classified based on the incident's characteristics. For certain risk-based classifications of incidents, the CEO and other members of the executive leadership team are also informed and contribute as part of our incident response processes.

companyName: INTUIT INC.

ticker: INTU


text: Our CITO, who reports to our Chief Executive Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer. Our Chief Information Security Officer supports the program and incident response and reports to the CITO.

companyName: UNIFIRST CORP

ticker: UNF


text: We regularly engage assessors, consultants, auditors and other third parties to support our enterprise information security program. These engagements encompass a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: MKS INC

ticker: MKSI


text: The VP of IT reports to the Chief Financial and Strategy Officer and is the head of the Company's cybersecurity team. Through ongoing communications, the VP of IT and the Executive Leadership Team, which includes our Chief Executive Officer, Chief Financial and Strategy Officer, and Chief Administrative and Legal Officer, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: We maintain a CIRT, whose responsibilities are described above. We conduct periodic tests with this team to maintain readiness and resiliency while regularly reviewing its policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and cybersecurity consultants.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: In connection with these policies, we deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: PubMatic, Inc.

ticker: PUBM


text: Board of Directors oversees cybersecurity risk management in compliance with SEC guidance. Management's role includes assessing and managing material risks from cybersecurity threats, developing and implementing cybersecurity policies and procedures, and ensuring date, we have not experienced any material cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business operations, financial condition, or results of operations. We remain vigilant in our efforts to protect against potential threats and continually assess our cybersecurity posture to adapt to the evolving threat landscape.

companyName: HALLMARK VENTURE GROUP, INC.

ticker: HLLK


text: With the guidance of the Audit & Risk Management Committee, our Board is responsible for our risk management framework, including our strategy, policies, procedures and systems with respect to cybersecurity and information technology risks associated with us and our supply chain, suppliers and service providers. Our management team has developed and implemented a risk management program that includes cybersecurity risks as a risk category. Management has primary responsibility for supervising internal staff and external consultants assisting with cybersecurity matters, including those that assist management in staying informed about cybersecurity risks and incidents. Management updates the Committee on our cyber risk management program, and the Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Tamboran Resources Corp

ticker: TBN


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer, General Counsel, and Director of Information Technology. Such individuals have collectively several years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant degrees and certifications. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: Inhibrx, Inc.


text: Information Security Program PNC's approach to cyber risk management, oversight and reporting is based on a well-structured information security program. The program is responsible for protecting information assets to achieve business objectives in a secure manner and designed to keep customers' information and their funds safe and available. Program capabilities are built against industry guidance and a security framework to identify risks to sensitive information, protect that information and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Engagement of Third-Party Advisors We engage third-party advisors, including assessors and cybersecurity consultants, to assess, validate and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks and review cybersecurity strategy, trends and threat landscape.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Resiliency and Contingency Planning – Risk assessments are performed on a regular basis to assess the IT risk of single points of failure, security maturity, and security vulnerabilities. The results of these assessments are used to define various resiliency and contingency mitigation strategies, corrective action plans, on-site and remote data back-up strategies and technologies and allocation of IT resources.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to, and breaches of, our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled, "Cyberattacks, security, privacy, or data breaches or other security incidents that affect our networks or systems, or those of our service providers, involving our or our customers' sensitive, personal, classified or confidential information could expose us to liability under various laws and regulations across jurisdictions, decrease trust in us and our products and services, increase the risk of litigation and governmental investigation, and harm to our reputation, business, and financial condition" in Item 1A- Risk Factors - "Information Technology and Data Risks."

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: However, due to evolving cybersecurity threats, and despite security measures taken, it may not be possible to anticipate, prevent, and stop future cybersecurity incidents, including attacks on information systems and data or those of relevant business partners. Additional information on cybersecurity risks identified is discussed in Item 1A of Part I, "Risk Factors", which should be read in conjunction with this Item 1C. Cybersecurity.

companyName: VALVOLINE INC

ticker: VVV


text: Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of our efforts to eliminate cybersecurity risks. The Audit Committee meets regularly with our Chief Executive Officer and Chief Financial Officer and, in turn, reports its finding to the Board of Directors.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: This includes protecting against known and evolving threats to the security of the Company's systems and information, and against unauthorized access, compromise, or loss of data. The Cybersecurity System is managed centrally, so the same security controls, policies and procedures are implemented across the organization. The Company maintains cybersecurity policies including an Acceptable Use Policy that all system users sign to acknowledge that they understand their security responsibilities. All system users receive security awareness key element of the Company's Cybersecurity System is to mature the program to align with the Center for Internet Security (CIS)

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Our board of directors plays an active role in overseeing the company's approach to managing cybersecurity risks. The board receives regular updates from senior management regarding the company's cybersecurity strategy, potential risks, and any incidents that may arise. These updates ensure that the board remains informed and able to provide guidance on cybersecurity matters.

companyName: cbdMD, Inc.

ticker: YCBD


text: Our board of directors (the "board") considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the "committee") oversight of cybersecurity and other information technology risks. The committee oversees management's implementation of our cybersecurity risk management program.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: The CISO reports directly to the CIO and is responsible for: • Overseeing and implementing CPKC's cybersecurity strategy; • Aligning cybersecurity objectives with the overall business objectives; • Ensuring compliance with regulatory directives related to cybersecurity; • Promoting a cybersecurity culture through comprehensive awareness and training programs; and • Managing and coordinating incident response activities.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, which may include professional services firms (such as legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy program reflects this by incorporating internal and third-party audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.

companyName: Certara, Inc.

ticker: CERT


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VIII LLC


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company's information security program is managed by its CEO and CFO, and Vice President of Operations, who are responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: C-Bond Systems, Inc

ticker: CBNT


text: While Peoples has implemented security controls and processes to mitigate against cybersecurity threats, Peoples cannot be certain that these measures will be successful. The threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Peoples has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, Peoples' systems and those of its customers and third-party service providers are under constant threat and it is possible that Peoples could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by Peoples and Peoples' customers. Any breach, compromise or disruption of its information security or systems as a result of a cybersecurity incident or threat could result in damage to Peoples' reputation, loss of customer business, increased costs of incentives to customers or business partners in order to maintain their relationships, litigation, increased regulatory scrutiny and potential enforcement actions, repairs of system damage, increased investments in cybersecurity (such as obtaining additional technology, making organizational changes, deploying additional personnel, training personnel and engaging consultants), increased insurance premiums, and loss of investor confidence and a reduction in the price of Peoples' common shares, all of which could result in financial loss and material adverse effects on Peoples' results of operations and financial condition.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel, cybersecurity consultants, cybersecurity software providers and penetration testing firms.

companyName: SunPower Inc.

ticker: SPWR


text: The CITO, who has served in this role for over eight years, regularly reports cybersecurity updates to our Chief Operating Officer who, in his dual role as Chief Financial Officer, is our primary liaison with the Audit Committee. To inform about these updates and help guide cybersecurity related activities across our organization, the CITO has assembled a cybersecurity focus group and steering committee that meets on a quarterly basis and is made up of experienced representatives from various of our cybersecurity risk management consultants, external network security experts and cloud storage providers. These meetings are chaired by the CITO and include discussion of our cybersecurity needs, taking into account the latest industry trends.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Village Farms International, Inc.

ticker: VFF


text: JFG tests its cybersecurity defenses regularly through automated vulnerability scanning to identify and remediate critical vulnerabilities. In addition, an independent vendor conducts annual penetration tests to validate its external security posture. For certain JFG businesses, JFG also conducts cyber incident tabletop exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by JFG's IT Risk team in collaboration with outside service providers as appropriate and members of JFG's senior management and Legal and Compliance teams. Learnings from these tabletop exercises and any events that JFG experiences are reviewed, discussed, and incorporated into its cybersecurity risk management processes as appropriate. In addition to JFG's internal exercises to test aspects of its cybersecurity program, JFG annually engages an independent third party to assess information system risks and the maturity of our cyber security program. The independent third party assesses the cybersecurity program against the Cyber Risk Institute Cyber Profile, a financial sector-focused framework based on the NIST Cybersecurity Framework, the results of which are reported to the JFG Board of Directors (the "JFG Board") and inform JFG's program.

companyName: Senior Credit Investments, LLC


text: In addition, the Company conducts frequent security awareness trainings for all employees, utilizes malware, antivirus, and spyware protections and has other protections in place for its network and users. The Company maintains robust end user and administrative user policies governing the use of Company technology. The Company also maintains cyber liability insurance coverage and performs regular vulnerability and penetration assessments.

companyName: EPR PROPERTIES

ticker: EPR


text: We currently do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial conditions. While we do not believe that any such risks have yet to materially affect the Company, the Company cannot guarantee that its ongoing and robust approach towards cybersecurity will be able to prevent all cybersecurity incidents that could have a material effect on the Company in the future. See Item 1A, Risk Factors, for more information on our cybersecurity-related risks.

companyName: KEWAUNEE SCIENTIFIC CORP /DE/

ticker: KEQU


text: We have experienced a limited number of immaterial cybersecurity incidents in the past, regularly experience cybersecurity attempts, and expect that we will continue to experience varying degrees of cybersecurity attempts and incidents in the future. To date, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Item 1A. Risk Factors" for additional discussion regarding the risks we face from cybersecurity threats.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: We continuously monitor our networks and systems and integrate threat intelligence feeds to evaluate evolving cyber threats. We conduct regular testing and simulation exercises, including engaging third-party service providers to perform penetration testing, to identify and address weaknesses in our defenses and engage third-party service providers to perform cybersecurity risk assessments, which are based on the National Institute of Standards and Technology framework. Cyber risks are considered and addressed for those third-party relationships deemed critical to our operations, as well as those with access to or custody of confidential data or customer non-public information, including PHI, and those services or products accessed in a cloud environment or involving generative artificial intelligence or other machine learning technologies.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: Identifying and assessing cybersecurity risk is integrated into our enterprise risk management. We have implemented incident response and breach management processes that include the following steps: mobilizing the right stakeholders and containing the attack, maintaining trust with all affected stakeholders and understanding the attack, recovering the most critical business operations, and learning from the attack. We also conduct tabletop exercises to, among other things, align activities and expectations in connection with our incident response processes, discuss strategic questions, and review third party recommendations.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: As to experience of the various members of Coherent's cybersecurity functional team, the CIO is a technology executive with over 25 years of experience at public companies, specializing in IT leadership, cybersecurity, and strategic technology initiatives, including leading risk management, data governance, compliance, and SOX audits, aligning technology with business goals and robust data protection. He holds a B.S. in Electrical Engineering and ITIL certification. The Coherent Global Privacy Officer earned a B.A. and a Juris Doctor degree and has over 20 years of experience in legal practice, focusing specifically on privacy law for the past eight years. Additionally, the Coherent Global Privacy Officer is an active member of the International Association of Privacy Professionals (IAPP) and holds both the Certified Information Privacy Professional/Europe (CIPP/E) and Certified Information Privacy Manager (CIPM) certifications from the IAPP. The General Counsel for Technology and Risk Management holds a B.S. in Industrial Engineering, and a Juris Doctor degree and has over 38 years of experience in legal practice, 25 years of which specifically representing businesses and financial institutions in data security and privacy in both private practice and as at in-house attorney at various private and public companies. The Senior Manager, Security, Risk & Compliance, has been in Information Technology for 25 years and in IT security for 16 years, and holds a B.S. in Computer Science, with a minor in Mathematics, and an ISC2 CISSP Certification. He is a member of the ACM and a Senior Member of the IEEE. The Senior Director of Information Security is a CISSP and member of ISSA, practicing security for over 30 years, with a B.S. degree. He also has served as a consultant and has managed international cybersecurity teams with Fortune 100 companies in finance, banking, technology, biotech, security consulting, and large manufacturing in broad areas of cybersecurity. The VP of IT Infrastructure Operations and Interim Head of Information Security and Compliance has 25 years of experience at public companies, specializing in IT leadership, cybersecurity, and strategic technology initiatives, and holds a M.S. in Electrical Engineering.

companyName: COHERENT CORP.

ticker: COHR


text: The Board of Directors recognizes the significance of cybersecurity threats to the Company's operational integrity, data security and stakeholders. The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and sees this as a major priority for the company. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to our Company and an Investment in our Shares—We may face a breach of our cyber security, which could result in exposure of confidential information and adverse consequences to our operations."

companyName: Apollo Asset Backed Credit Co LLC


text: The ISSC includes members of management with specific cybersecurity expertise, including the Senior Vice President ("SVP") – Information Technology. The SVP – Information Technology, is a Certified Community Banker Technology Officer, has 20 years of experience in the information technology field, and is responsible for developing and implementing the Company's information security program.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: The Board of Directors oversees risks relating to cybersecurity. The CISO and Chief Financial Officer present to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. Apyx outsources the majority of our IT services and security to a well-respected company in the industry.

companyName: Apyx Medical Corp

ticker: APYX


text: Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company's incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: The company engages a third-party with extensive experience in cybersecurity to periodically perform a maturity analysis of CarMax's cybersecurity program as compared to peer companies. We conduct annual tabletop exercises, guided by a third-party cybersecurity firm, with key members of our cybersecurity and legal teams to assess the company's readiness and capabilities to respond to a cyber-attack. At least annually, we also conduct third-party penetration tests to enhance the security of our digital systems, and we employ network scanning to help us identify any newly developed vulnerabilities or threats. Our third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, CarMax's cybersecurity team conducts reviews of the company's third-party vendors depending on the vendor's risk profile as determined by the company's cybersecurity team.

companyName: CARMAX INC

ticker: KMX


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO). The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to, configuration management, vulnerability scans, network protection and monitoring, remote monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.

companyName: Banzai International, Inc.

ticker: BNZI


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents during 2023, 2022 or 2021, and any costs or operational impacts related to cybersecurity incidents were immaterial during this period.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our reputation, as well as our operations, business strategy, operating results, and financial condition.

companyName: Jet.AI Inc.

ticker: JTAI


text: Company relies on its Management and employees to execute its comprehensive cybersecurity program, and has adopted a written information security program, which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: The Board of Directors provides oversight of the risk management program and setting the Corporation's cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. The Board has appointed a Risk Management Committee currently made up of five members of the Board with governance and oversight of the Corporation's enterprise-wide risk management program. The members of the Risk Management Committee collectively have years of business management and professional experience in the banking industry and other industries including exposure to cyber risk management considerations. The Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters. In fulfilling its role, the Risk Management Committee is actively engaged with management regarding cyber security procedures and controls to manage and mitigate cybersecurity-related risks. Management provides at least quarterly information security reports to the Risk Management Committee who provides a report to the Board of its discussions and decisions. These reports to the Risk Management Committee address management's efforts to monitor, detect and prevent cyber threats. In addition, the Board of Directors is engaged, as needed, in accordance with the Incident Response Plan.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: The CISO and the CIO have significant experience in information technology and cybersecurity, including over 20 years of experience each in information security and compliance, multiple security certifications, and experience building vulnerability management, application security, and security operations groups. Additionally, their experience includes payments fraud prevention and enhancing the organization's ability to safeguard against financial cyber threats, among other intrusions. Our CIO and CISO combine leadership, familiarity with and resolution of various cyber-related perils, to help mitigate these types of risks for the Company. Due to their experience in the field, they play a pivotal role in informing the Board on cybersecurity risks. They provide briefings to the Board on a quarterly basis. These briefings encompass a broad range of topics, including: • The current cybersecurity landscape and emerging threats; • The status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • The Company's compliance with regulatory requirements and industry standards Cybersecurity Risk, Data Risk, and Technology Infrastructure Risk are among the risks assessed by the Company's Enterprise Risk Management Program with the oversight of an executive-level Enterprise Risk Management Committee. Information Technology, Information Security, product development, and Internal Audit managers update the CISO, CIO and CEO on technology, cybersecurity, and privacy threats, risk mitigation efforts, penetration testing, and control testing at a regular Enterprise Security Meeting. In addition to scheduled meetings, the CISO, CIO, and CEO maintain a regular dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, as needed, but no less than quarterly, supporting the Board's proactive and responsive oversight of cybersecurity-related risks. This engagement also supports the consideration and integration of cybersecurity matters into the broader strategic objectives.

companyName: Everi Holdings Inc.


text: d.provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: EXAGEN INC.

ticker: XGN


text: Our institution has purchased and is using best of breed tools in the areas of endpoint security, Security Information Event Management ("SIEM"), Privileged Access Management ("PAM"), email and web browsing filtering and management, and user analytics. We also use a comprehensive third party 24-by-7 Security Operations Center ("SOC") that monitors, detects, and remediates cybersecurity threats adhering to strict service response levels.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. This cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-35 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training.

companyName: CEVA INC

ticker: CEVA


text: Although the Board oversees our overall risk management, day-to-day management of cybersecurity risk is the responsibility of management. Management's critical role involves assessing and managing these risks through regular evaluations, deploying advanced security measures, and developing policies. Management integrates these strategies across all our operations, fostering a culture of cybersecurity awareness within the Company. This proactive stance is essential to safeguarding digital assets and ensuring operational resilience against evolving cyber threats.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Under the Cybersecurity Program, systems and networks under Company control are monitored for anomalies using various security tools that identify potential cybersecurity threats and alert the Company's internal cybersecurity team to suspicious activity. If a potential cybersecurity incident is identified, it is investigated by the Company's internal cybersecurity team (including the Company's Chief Information Security Officer (the "CISO")) to assess whether a cybersecurity incident has occurred, its severity and the risk involved, in accordance with internal processes and procedures and the Company's incident response plan. The CISO is responsible for management of these cybersecurity processes, and reports to the Company's Chief Information Officer (the "CIO"). The CISO and CIO will receive input from, and coordinate with, the Company's Chief Privacy Officer (the "CPO"), as necessary. If a cybersecurity incident is discovered, it must be reported by the CIO and the CISO to the Company's senior management, including the Company's Chief Financial Officer and the Company's General Counsel for further assessment regarding scope, mitigation, remediation and disclosure obligations, as applicable. The audit committee of our board of directors oversees the Company's information security and cybersecurity risks, compliance and protections, and receives quarterly cybersecurity updates from the CISO and CIO (with input from the CPO, as appropriate) and results of the Company's incident response plan testing at least annually.

companyName: OUTFRONT Media Inc.

ticker: OUT


text: We perform an annual training exercise for all employees and hold several cybersecurity awareness campaigns throughout the year. Where deemed appropriate, we engage independent security professionals to evaluate the Company's security environment. For example, we comply with Payment Card Industry Standards and are audited annually by a third party to confirm compliance with those Standards. In addition, the Company employs third party penetration testers to identify potential security weaknesses for evaluation and remediation. We also partner with government organizations and industry associations to share intelligence and quickly respond to emergent threats.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: The Company has established an Incident Response Policy and recovery plans to address its response to a cybersecurity incident, and such plans will be tested and evaluated on a regular basis. This includes continuous security operation centers monitoring of the Company's systems and accounts.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Cybersecurity is a key element of the Company's enterprise risk management (ERM). Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis. Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Vice President of Information Technology. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: CITIZENS, INC.

ticker: CIA


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, employees and communities. The Board is actively involved in oversight of the Company's operational and strategic risk management process. With regard to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to cybersecurity and data-protection, including its assessment, identification and management of material risks, mitigation strategy, governance and incident reporting that are based on recognized frameworks established by the National Institute of Standards and Technology (NIST), the International Organization for Standardization and other applicable industry standards. The entire Board receives periodic updates on the Company's cybersecurity risk management progress through the Company's general enterprise risk management ("ERM") program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: This includes updates on our processes to prevent, detect and mitigate cybersecurity incidents. In addition, the Audit Committee is responsible for reporting information about such risks to the Board of Directors and material cybersecurity risks and/or events are reviewed by the Board of Directors, at least annually, as part of our corporate risk oversight processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: The company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the company under the heading "Cybersecurity incidents as well as ransomware may hurt the company's business, damage its reputation, increase its costs, and cause losses," included as part of the company's risk factor disclosures in Item 1A of this Annual Report on Form 10-K. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the company, including its financial condition, results of operations, or business strategies.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: While we have not been subject to cyberattacks and other cyber incidents, we take cybersecurity preparedness seriously. Our risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. We have plans to implement cybersecurity training for all employees upon onboarding, and then annual follow-up training courses to ensure that all employees understand the risk and implications of a cyber event.

companyName: Ispire Technology Inc.

ticker: ISPR


text: Additionally, we require all vendors with whom we have a direct contract or agreement, with limited exceptions, to comply with the Vendor Code of Business Conduct. Vendors are required to maintain the confidentiality of information entrusted to them by us. Additionally, the Vendor Code of Business Conduct provides instructions for vendors to report violations confidentially.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Roivant's corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cybersecurity threat and incident detection and response centrally at Roivant and the majority of our Vants. Certain of our Vants, including Immunovant, Dermavant and our healthcare technology Vants, have established and maintain separate cybersecurity functions which are similarly designed to protect their information and assets from cybersecurity threats or incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of internal and external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, Federal Financial Institution Examination Council Cybersecurity Assessment Tool, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Information and Operations Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions and maturing our Information Security Program.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: The Board of Directors receives an evaluation of cybersecurity risks, which includes detailed descriptions of the actions we have taken to accept, transfer, or mitigate these risks and an analysis of cybersecurity threats and incidents across the industry. The Board of Directors reviews the evaluation on an annual basis. Management will provide a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: As part of its Standard Operating Procedures, RPC has adopted Incident Response Policy (IRP), Data Loss Prevention Policy, and other policies regarding key areas of information security. These policies are reviewed periodically and updated as needed to address emerging risks or gaps in compliance. The IRP also includes guidance on internal and external escalation in the event of an incident or breach. RPC has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed by the cybersecurity team to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors, We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: RPC INC

ticker: RES


text: Weatherford personnel conduct risk assessments on third-party products and platforms through a structured checklist-based review and interview process that aim to validate implemented security controls and mitigate risk to our organization. This process includes evaluating security architecture, verifying certifications and reviewing results of external security assessments. Additional documentation may be requested to clarify technical measures, compliance reports or risk treatment plans. Cybersecurity approval is a key factor in approving a new third-party product or platform.

companyName: Weatherford International plc

ticker: WFRD


text: We maintain Information Systems Incident Management Standards applicable to all our businesses that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our disclosure controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. Risk Factors.

companyName: TEXTRON INC

ticker: TXT


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by external consultants and auditors. These assessments include various activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022 and 2023, we conducted an independent cyber security maturity assessment and external penetration test to assess our controls against the NIST Cybersecurity Framework. The results of significant assessments are reported to management, the Audit Committee and Board. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also completed cybersecurity attestations that demonstrate our dedication to protecting the data entrusted to us.

companyName: PGT Innovations, Inc.


text: As previously discussed in "Item 1. Business" the Partnership is managed by GPB, through its affiliation with Highline. Among the services provided to the Partnership under the MSA is a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Partnership's enterprise risk management system as administered and overseen by Highline and addresses the corporate information technology environment.

companyName: GPB Automotive Portfolio, LP


text: The Audit Committee or the full Board receive quarterly cybersecurity updates, which are prepared by our Vice President of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.

companyName: SEMTECH CORP

ticker: SMTC


text: The Company uses the Center for Internet Security ("CIS") Critical Security Controls framework to balance cybersecurity risk exposure with investment in mitigation strategies. This framework provides a prescriptive, prioritized set of cybersecurity safeguards that fully align with those of the National Institute of Standards and Technology, the International Standards Organization 27000 series, and the requirements and guidance from applicable regulatory authorities, including the Federal Financial Institutions Examination Council.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP