text: Our CISO meets with our Audit Committee at least annually to discuss cybersecurity risk and related issues. These meetings may encompass a broad range of topics, including: • cybersecurity initiatives and strategies, • cybersecurity events, • emerging threats, • regulatory requirements, and • industry standards.

companyName: FLUOR CORP

ticker: FLR


text: As an externally managed company, our day-to-day operations are managed by BFIM, under the supervision and with the participation of the Principal Executive Officer and Principal Accounting and Financial Officer. Our business is highly dependent on the communications and information systems of BFIM, its affiliates and third-party service providers. BFIM is an affiliate of ORIX Corporation USA ("ORIX USA"), a diversified financial company and a subsidiary of ORIX Corporation ("ORIX") and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and BFIM relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: BCTC IV ASSIGNOR CORP

secItem: Item 1C


text: The Bank maintains an Enterprise Risk Management Framework which is updated and approved at least annually by its Board of Directors. The framework outlines the methodology and elements that are used to manage Bank-wide risks, including cybersecurity risks, and it assigns responsibilities for the Bank's enterprise risk management. The Bank's IT Security department measures cybersecurity risks by way of risk assessments that utilize a scale which includes both the likelihood and impact of risk occurrence. The scale used to measure likelihood and impact is tied to the criteria contained in the Bank's Enterprise Risk Management Framework.

companyName: Federal Home Loan Bank of Dallas


text: In the last three years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: The Company takes an active, multi-faceted approach to cybersecurity, including adversarial engagement, under an "assume breach" philosophy premised on the continuous and ever-evolving nature of cyber threats and threat actors. The Company utilizes a cross-functional working group comprised of a Cybersecurity Department, which is responsible for overseeing cybersecurity for the Company's information systems; and plant operational technology (OT) personnel who are responsible for the security of plant OT. This group works in a cross-functional context due to the interconnectivity of these systems, as well as to collaborate about cybersecurity matters. The Company's Cybersecurity Department is headed by the Director of Global Cybersecurity, who reports to the Company's Chief Information Officer, and includes personnel located around the world who have cybersecurity training and skills in engineering, architecture, surveillance, analytics and administration. The Cybersecurity Department is responsible for setting the Company's cybersecurity policies, standards and benchmarks for its information systems, penetration testing and overseeing repairs of technical elements that fail testing. The Cybersecurity Department also conducts threat hunting within the Company's information systems and responds to threats. The Cybersecurity Department also engages certain third-party specialists to periodically review the Company's information systems and cybersecurity defenses, as well as to provide education about current and emerging threats, techniques and countermeasures. The Cybersecurity Department has also conducted cyber-attack simulation exercises with Company executive management and other leadership personnel for cyber-attack readiness. The Company's Director of Global Cybersecurity and Chief Information Officer also collaborate with our joint venture partner concerning cybersecurity matters for the DGD Joint Venture.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: Certain of our board members, including certain members of our Governance and Nominating Committee and the Technology Committee have backgrounds or experience in risk management and/or information technology. On at least an annual basis, the Governance and Nominating Committee receives updates from our CISO, Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. The Board of Directors also receives regular reports from the Governance and Nominating Committee and the Technology Committee on these and other risk-related matters as necessary. Our CISO provides information to the Technology Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed designated thresholds.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Our Chief People Officer, CTO and recruiting personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our management, including our CTO and Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Xometry, Inc.

ticker: XMTR


text: Consistent with our prioritization of information and technology protection, cybersecurity risk management has been and remains a key aspect of our overall business strategy, financial planning and capital allocation and a point of ongoing emphasis at all levels of our Company.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our Chief Information Officer, who reports to the Chief Financial Officer, and has over 30 years of experience managing information technology and cybersecurity matters, together with our executive management team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Legal and Regulatory Requirements."

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: The Compliance and Regulatory Affairs Committee of the Board (the "Compliance and Regulatory Affairs Committee") provides oversight of risks from cybersecurity threats. The Compliance and Regulatory Affairs Committee receives updates from our Chief Information Security Officer ("CISO") and other members of management to, among other items, review material cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. The Compliance and Regulatory Affairs Committee updates the full Board on matters relating to cybersecurity. The Audit Committee of the Board provides an additional layer of cybersecurity oversight on specific financial matters.

companyName: Evolent Health, Inc.

ticker: EVH


text: To date, other than the 2020 Incidents, the Company has not experienced a cybersecurity threat or incident that has materially affected or that we believe is reasonably likely to materially affect the Company including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and other security breaches or disruptions suffered by us or third parties upon which we rely could have a materially adverse effect on our business, harm our reputation and expose us to public scrutiny and liability." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Dave Inc./DE

ticker: DAVE


text: We have performed simulations and tabletop exercises at a management level. Our employees are required to complete cybersecurity training at least once every year and have access to more frequent cybersecurity trainings online. We also require certain employees to complete additional role-based cybersecurity trainings. Our information security team regularly monitors for potential cybersecurity incidents and we have processes in place designed to escalate within the company more serious incidents, as appropriate.

companyName: PATTERSON COMPANIES, INC.


text: Relevant Regulations As a regulated financial institution, BankPlus is also subject to financial privacy laws and the Company's cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Financial Privacy and Cybersecurity."

companyName: BANCPLUS CORP


text: Truist Financial Corporation 41 Management's role in assessing and managing material risks from cybersecurity threats Truist's Information Security Program is operated and maintained by management, including the CIO, interim CISO, and CRO. These senior officers are responsible for assessing and managing Truist's cybersecurity risks. Our Information Security Program also includes processes for escalating and considering the materiality of incidents that impact Truist, including escalation to executive management and the Board, which are periodically tested through tabletop exercises to assess Truist's preparedness. Our cybersecurity framework strategy, which is overseen by the interim CISO, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Our process includes assessing, mitigating, and managing risk in three categories: cybersecurity or technical risk, vendor risk, and compliance and regulatory risk. To support those risk management categories, we partner with third parties in the implementation of tooling to help us decrease cyber risks and ensure compliance within Allegiant and with third parties. We verify third-party compliance, such as suppliers and business partners, by aligning with several standards. For example, we subject our IT suppliers to the Sarbanes-Oxley ("SOX") and payment card industry ("PCI") compliance standards where applicable.

companyName: Allegiant Travel CO

ticker: ALGT


text: Prevention and Preparation As noted above, we utilize our MS Provider for cloud-based information technology services. This third-party solution includes 24/7 monitoring and is consistent with a well-recognized cybersecurity framework. We also engage a nationally recognized public accounting firm to perform periodic cybersecurity assessments, which entail performing a qualitative current state evaluation of our cybersecurity program in line with specific domains within the recognized third-party framework. In addition, we take the following preventative measures: • We engage a third party to perform internal and external penetration tests on an annual basis. • We require multi-factor authentication and other enhanced security measures for our network and primary applications. • We utilize geolocation-based blocking and mobile device management.

companyName: LXP Industrial Trust

ticker: LXP


text: As of the date of this Annual Report, we do not believe that any past cybersecurity incidents that have been detected have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: No risks from cybersecurity threats have occurred that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: Our Board of Directors plays a pivotal role in overseeing the organization's preparedness for cyber threats. This involves a comprehensive understanding of our risk profile, ensuring appropriate cybersecurity controls are in place, regularly reviewing the effectiveness of these measures, and maintaining a robust incident response plan. The Board's involvement extends beyond compliance and budget approvals to active participation in continuous cybersecurity strategy improvement. The Board enhanced its cybersecurity expertise with the addition of Joanna Burkey in March 2023. Ms. Burkey has an extensive cybersecurity background and has served as CISO at both HP and Siemens.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: We regularly evaluate our Information Security Program based on software vendor assessments and reports, insurance underwriter evaluations, and internal and external audits, including customer audits. We also periodically engage third parties to review the effectiveness of its Information Security Program. To date, these engagements have included third-party penetration testing, risk identification, and a fiscal year 2023 comprehensive evaluation of the maturity of our Information Security Program.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: The Trust does not have a board of directors, so the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: Cyber Risk Management and Strategy Our manager of information technology works in conjunction with our third-party managed security service provider to establish and maintain our cybersecurity risk management processes, which are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our internal information technology resources to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications.

companyName: MYOMO, INC.

ticker: MYO


text: The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of implementing and maintaining preventative controls, identifying and monitoring threats and maximizing chances of recovery in the case of a cybersecurity incident.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: The Committee's members include senior members of management who are responsible for and collectively have experience in information security, information technology, data protection, risk management and compliance. This collaboration helps us incorporate cyber risk management across all of our significant risk management programs.

companyName: HUBSPOT INC

ticker: HUBS


text: Our cyber and information security risk management framework and strategy is focused on the following key areas:

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Our Board and our Board Committees are actively engaged in the oversight of our information security program. Before the establishment of our Risk Oversight Committee, our Audit Committee assisted our Board of Directors with its oversight of risks associated with Etsy's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. In December 2023, our Board approved the formation of a Risk Oversight Committee to assist the Board with its oversight of Etsy's management of risk exposures, including oversight of technology and information security related risks (which responsibility will move from the Audit Committee to the Risk Oversight Committee), as well as oversight of management's processes for effectively monitoring and mitigating risk.

companyName: ETSY INC

ticker: ETSY


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Monitoring Cybersecurity Incidents The CISO continually monitors for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We deploy defense-in-depth safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments as well as ongoing acquisition of knowledge crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and prevent escalation of any loss or damage from the cybersecurity incident. The Incident Response Plan is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response teams (i) include subject matter experts to address cyber threats and (ii) includes representatives from the accounting team to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats We maintain an Information Security Program that specifies how we execute our cybersecurity framework. The Information Security Program is designed to assess, identify, and manage risks arising from the cybersecurity threats facing Truist. Truist maintains cybersecurity and information security policies, procedures, and technologies that are intended to protect our clients', teammates' and our own data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning. For example, to further mitigate the risks presented by an evolving cyber threat landscape, Truist: • provides data protection guidance to clients; • promotes data protection awareness and accountability through mandatory teammate training; and • conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of Truist's crisis response and management programs and provide the basis for improvement.


text: To date, there have been no cybersecurity events in the past that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to help respond to sophisticated and rapidly evolving threats that may try to circumvent our security measures.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: The Bank's Cybersecurity Incident Response Plan determines how cybersecurity incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to senior management and the Board. The Bank's Cybersecurity Incident Response Plan also stipulates management assess the materiality of the incident for the purposes of public disclosure.

companyName: Federal Home Loan Bank of San Francisco


text: Our cybersecurity risk management methodology risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;

companyName: SurgePays, Inc.

ticker: SURG


text: The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework. The Cybersecurity Program is developed and reviewed by the Company's executive leadership alongside the Company's Audit Committee and carried out and overseen by the senior person in charge of IT at the Company, currently our Chief Compliance Officer ("CCO").

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: Technical Safeguards: Our Manager deploys technical safeguards that are designed to protect the Company's and our Manager's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Additionally, we have adopted a documented Incident Response Plan that applies in the event of a cybersecurity incident to provide a standardized framework for response. In general, our incident response process follows the NIST 800-61 framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.

companyName: GARTNER INC

ticker: IT


text: Our CIO has led our efforts since 2016, overseeing multiple acquisitions while modernizing the IT environment. He has held technology leadership roles in both the public and private sectors, with more than 20 years of experience as an IT leader in the homebuilding industry. In that time, our CIO has managed broad initiatives and teams, including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO reports to our Corporate General Counsel.

companyName: Century Communities, Inc.

ticker: CCS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management. Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager. Our CDO has over 15 years of experience in IT and previously served as the Chief Information and Digital Experience Officer for a home automation company. Prior to that, she held various leadership roles at a computer software company.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We have developed and maintain an incident response plan that provides a documented procedure to respond and address cybersecurity incidents, including timely notification to the Executive Management Committee and the Risk Committee of the Board of Directors. The incident response plan provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. Our incident response plan is tested at least annually.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: Cybersecurity is a critical component of our overall risks given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a member of the information technology organization, reporting directly to the Chief Information Officer and regularly reports on the state of the program to the Risk Committee of our Bank's Board of Directors.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: As part of the Company's approach to cyber risk management, the Company performs internal audits of internal processes and controls relating to cybersecurity. Every year, the Company engages third -party experts to conduct cyber penetration testing. Based on their findings and recommendations, the Company makes the appropriate updates to its cybersecurity software.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: We also review our cybersecurity practices, their effectiveness, and the cybersecurity practices of the third-parties we rely on, on an ongoing basis and make changes as necessary to address new risks. However, we cannot guarantee that our efforts will be successful in preventing all cybersecurity incidents.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: We engage third parties annually to evaluate our information security posture, risks, and third-party service provider solutions as part of our overall enterprise risk management activities. The company maintains an inventory of vendors and third-party providers and evaluates those providers for risks annually at a minimum.

companyName: Urgent.ly Inc.

ticker: ULY


text: The Company's Information Security team is responsible for identifying, assessing, and mitigating cybersecurity risks. The Information Security team reports to the head of Information Technology, who reports to the Chief Technical Officer who reports to the Chief Executive Officer. The Information Security team also briefs the Security Committee (which consists of the Chief Technical Officer, CEO, CFO and Chief Legal Officer) regularly about the cyber threat landscape, their plans to mitigate cybersecurity risks and their responses to cybersecurity incidents.

companyName: QUINSTREET, INC

ticker: QNST


text: Our SIRP is dynamic and adaptable, evolving in tandem with the ever-changing cybersecurity landscape. By regularly updating and refining our response strategies, we remain prepared to confront emerging threats. The Company also maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives periodic briefings from management on our cyber risk management program. From time to time, board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity personnel, and/or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: Hyatt Hotels Corp

ticker: H


text: Our information security program is led by our Chief Information Security Officer (CISO) who manages a global information security team responsible for assessing and mitigating cyber-related threats. The cybersecurity expertise of our CISO and his team includes information security management roles, hands-on cyber incident response experience, forensic and network intrusion investigations and security risk assessments.

companyName: Element Solutions Inc

ticker: ESI


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to BXINFRA.

companyName: Blackstone Infrastructure Strategies L.P.


text: We continuously assess technology risks and threats and monitor our information systems for potential vulnerabilities based on industry trends and evolving threats. We use our IRP to identify, protect, evaluate, respond to and resolve information security incidents. We conduct regular reviews of our information security program and also validate our IRP by conducting tabletop exercises, penetration and vulnerability testing, red team campaigns to identify potential vulnerabilities, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our IRP. Our auditors perform independent audits on aspects of our information security program for assurance purposes. We occasionally engage third-party assessors to assess different aspects of our information security program. We conduct regular training for employees on different cybersecurity topics and best practices. We also conduct a risk-based analysis on third-party vendors that we engage to process personal data and confidential information for us and provide them with our information security requirements prior to their engagement.

companyName: Chewy, Inc.

ticker: CHWY


text: Our cybersecurity risk management is integrated into our overall risk management system. Our IT department works closely with our management and other relevant teams to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported on at least a quarterly basis to our Executive Compliance Committee, as described further below, to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: Risk Management & Strategy Our cybersecurity risk management process is a component of our overall approach to managing material risks that could impact our operations, including cybersecurity threats. In general, we seek to manage material internal and third-party cybersecurity risks through an approach that focuses on: (i) protecting information systems and the information residing therein; (ii) identifying, preventing, and mitigating cybersecurity threats; and (iii) assessing and responding to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program—in an effort to ensure that it remains reasonable and appropriate in light of changes in the security threat landscape, available technology, and applicable legal and contractual requirements—is an ongoing effort.

companyName: Celcuity Inc.

ticker: CELC


text: Because it has not conducted a formal standalone IT risk assessment, Estrella's process for assessing, identifying, and managing material risks from cybersecurity threats has not been fully integrated into its overall risk management system or process. Estrella does not have a formal process established to oversee and identify cybersecurity threats and risks associated with its reliance on the third-party IT support provider of Eureka. However, it has implemented several key cybersecurity measures, focusing heavily on cloud-based solutions to protect its financial data and communications.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: Our CISO has served in various roles in risk management and enterprise and cybersecurity for over 20 years, including serving as Deputy CISO at a global cybersecurity software company. Our CISO has attained numerous professional certifications, including Certified Information Systems Security Professional, Certified in Risk and Information Systems Control, Certified Information Security Manager, Certified Information Systems Auditor, and GIAC Security Operations Manager. Our CEO, who has decades of software engineering experience, has served as our CEO and as a member of our Board for fourteen years, during which time he has overseen our ERM program, including risks arising from cybersecurity threats. Our CFO and General Counsel each have more than 20 years of experience managing risks, including both at the Company and with other public companies. The other members of our Executive Steering Committee are all experienced leaders in their respective areas of management with extensive SaaS operational experience.

companyName: PROS Holdings, Inc.


text: Management's Role in Cybersecurity Risk Management TIAA's management, including its Chief Information Security Officer ("CISO"), is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Account. The CISO and cybersecurity leaders have significant expertise in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. In particular, the CISO holds an master of business administration (MBA) degree and a bachelor of science (BS) degree in computer science. He has several security industry certifications including the Certified Information Systems Security Professional (CISSP) and Certified Secure Software Lifecycle Profession (CSSLP) designations, and has held prior management positions in the technology space with Snap Finance, American Express, Visa and Paypal. Management of the Account is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Account, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: TIAA REAL ESTATE ACCOUNT


text: We also engage consultants and other third -party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with our third -party providers, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response.

companyName: BROADWIND, INC.

ticker: BWEN


text: Management and Strategy are committed to protecting information and the underlying information systems involved in the functionality of our products and the operation of our business. We assess, identify, and manage material risks from cybersecurity threats through various processes and procedures, including: assessing risks, ad hoc, to identify the potential impact and likelihood of various risks and scenarios and to determine appropriate mitigation strategies and controls; third-party manufacturer, partner, and supplier selection processes; (iii) utilizing procedures for responding to cybersecurity incidents; training our employees, incident response personnel, and senior management on cybersecurity awareness; monitoring the responsibilities of our information technology team and evaluating our cybersecurity posture and performance on an ongoing basis;

companyName: DNA X, Inc.

ticker: SONM


text: The Company has developed an information security program to address material risks from cybersecurity threats and incidents, which is integrated within its overall enterprise risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. Under the information security program, the Company performs one or more cyber risk assessments each year based on recognized industry best practices and standards and cyber threat intelligence. The risk assessments, together with risk-based analysis and judgment, are used to determine security measures and controls to address identified risks. The Company considers the following factors, among others, during its risk and control implementation assessments: the likelihood and severity of the risk; the impact on the Company, the Company's customers, associates and stockholders, and others if a risk materializes; the feasibility and cost of security measures and controls; and the impact of security measures and controls on operations and others.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Genworth's CISO is an information technology and security professional with 23 years of experience and 11 years of service at Genworth. In his 23 years of experience, he has held roles in information technology infrastructure administration, information technology infrastructure, security consulting and security administration. He received a Bachelor of Science Degree in Business Administration from Regent University and is a Certified Information Systems Security Professional (CISSP).

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. Our board of directors addresses our cybersecurity risk management as part of its general oversight function.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: Our management team is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Executive Officer currently we also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Chair of audit committee where appropriate.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" and "Our business continuity plans or data security systems could prove to be inadequate, resulting in a material interruption in, or disruption to, our business and a negative impact on our results of operations" in Item 1A. Risk Factors.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, and financial condition. For more information about these and other risks, see ITEM 1A. RISK FACTORS.

companyName: SB FINANCIAL GROUP, INC.

ticker: SBFG


text: Oilseeds manages cybersecurity and data protection through a continuously evolving framework, as described in further detail below. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve. We employ an array of data security technologies, processes, and methods across our infrastructure to protect systems and sensitive information from unauthorized access. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the management team on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities. The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management. Pursuant to the Company's incident response plan, any incidents are to be reported by the management team to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope. The Company is not aware of any previous cybersecurity incidents or threats that are reasonably likely to materially affect its business strategy, results of operations, or financial condition. For the fiscal year ended June 30, 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Australian Oilseeds Holdings Ltd

ticker: COOT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or joint venture partner could materially adversely impact us. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable. We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the DFARS and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. Government. These government contracting regulations may create challenges for our supply chain and increase costs. We also require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified. We also make available cybersecurity education and awareness materials and briefings to our suppliers.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: Roles and Capabilities Our CISO, in coordination with members of our senior leadership team such as our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel ("GC"), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats. Through ongoing communications with these teams, our CISO and senior leadership team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.

companyName: Crane NXT, Co.

ticker: CXT


text: The Head of Product and Operations is promptly informed of potential cybersecurity risks, threats, and vulnerabilities by any employees or consultants. Once an incident has been identified, the Head of Product and Operations and the security consulting team assess the criticality and impact of the incident on the Company's business operations. The Head of Product and Operations then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the senior leadership on all material incidents.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to "Part I, Item 1A. Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company, including the risk factor captioned "Cybersecurity attacks or security breaches or incidents impacting our systems or data could adversely affect our ability to operate, could result in personal information and our proprietary information being lost, stolen, made inaccessible, improperly disclosed or misappropriated and may cause us to be held liable or subject to regulatory penalties and sanctions and to litigation (including class action litigation), which could have a material adverse effect on our reputation and business."

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company has established a cybersecurity program (the "Program") that is designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 40 years of combined cybersecurity experience across architecture, engineering, operations and compliance.

companyName: Eventbrite, Inc.

ticker: EB


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Partnership's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Partnership should a cybersecurity incident occur.

companyName: CVR PARTNERS, LP

ticker: UAN


text: We regularly evaluate and assess the threat landscape and our security controls, including through audits and assessments, regular network and endpoint monitoring, vulnerability testing, penetration testing and tabletop exercises that include senior management. To assess the design and effectiveness of our cybersecurity controls, we engage with assessors, consultants, auditors and other third parties, including through independent third-party reviews of our information technology security program conducted on at least an annual basis. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including utilizing safeguards to protect sensitive data, performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence and contracting to manage cybersecurity risks in specified ways such as requiring agreements to be subject to periodic cybersecurity audits.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: The company's Enterprise Risk Management division provides risk-based independent oversight of cybersecurity risk management performed by the Information Security organization. The Technology Risk Committee and Enterprise Risk Committee are each chaired by a member of the Enterprise Risk Management division.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have implemented policies, programs and controls and invested in cybersecurity technologies that focus on assessing, monitoring, and managing our cybersecurity risks. These include, but are not limited to: maintaining comprehensive cybersecurity policies and practices; augmenting our organization with a global cybersecurity operation center that monitors cyber threats 24-hours a day on a year-round basis; new surveillance technologies to proactively identify threats and improve the Company's cyber defense capabilities; implementing enterprise-wide cybersecurity training, anti-phishing and awareness programs for our employees and crew members; and conducting cyber simulations with various teams across the Company as well as with management to evaluate our response approach. We have also implemented comprehensive processes designed to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which include security assessments on our suppliers and vendors and continuous monitoring of cyber threats. Our cybersecurity program is based on recognized best practices and standards for cybersecurity, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: SoundHound acknowledges the increasing importance of cybersecurity in its operations and recognizes the potential risks and threats associated with cyber incidents. The Company is committed to maintaining the confidentiality, integrity, and availability of its information systems and data. However, no system can be completely immune to cyber threats. We face a number of cybersecurity risks in connection with our business. To date, such risks have not materially affected our business, including threats to and breaches of our data systems, malware and computer virus attacks.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: Yale Transaction Finders, Inc.

ticker: YTFD


text: Information Security and Risk Management Overview The Company places a high priority and focus on securing the confidential information it receives and stores about its borrowers, depositors and other customers and employees as well as sensitive information regarding financial transactions and the Company's information systems. This priority and focus starts at the Company's board of directors, which is ultimately responsible for risk oversight, establishing the Company's risk appetite, understanding the Bank's key risks and assuring the risk management strategy, processes and internal controls are appropriate to manage risk, in each case inclusive of cybersecurity risk. The Company's board of directors approves an information security policy and program (the "Information Security Policy and Program"), which contains a statement of the Company's risk appetite with respect to cybersecurity matters, on an annual basis. The Company's risk appetite includes specific information security risk tolerance thresholds and limits established with the approval of the Company's board of directors and executive management. Key risk indicators are monitored by the Risk Oversight Committee of the Company's board of directors (the "Risk Oversight Committee"), which receives quarterly reports from the Company's Chief Risk Officer, Information Security Officer ("ISO") and Enterprise Risk Management Committee regarding management's efforts to protect the Company from cybersecurity threats and the general threat landscape facing companies with operational characteristics similar to the Company's. The Risk Oversight Committee reports quarterly to the Company's board of directors regarding the Company's cybersecurity risk oversight processes as the board of directors seeks to ensure the Company is operating within its stated risk appetite.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Management's Role Managing Risk The Vice President of IT Security and the Chief Information Officer ("CIO") play a pivotal role in informing the Audit Committee on cybersecurity risks. These individuals have over two decades of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations, including global retail e-commerce and mobile-commerce brands. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Audit Committee conducts a review at least annually of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Our Head of Information Technology, who reports directly to the Chief Operating Officer, has day-to-day responsibility for preventing, mitigating and remediating cybersecurity threats and incidents. The individual currently serving in this role has two decades of experience in information technology and cybersecurity. Our Disclosure Committee evaluates the materiality of any threats and/or incidents to determine if there is any required disclosure. Our external SEC counsel is also apprised of certain threats and/or incidents that may occur and is available to advise management on any disclosure obligations.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: Incident Response Plan: The Company has established an incident response plan in an effort to address and contain any breaches or cybersecurity incidents. This plan includes defining roles, responsibilities, and steps to recover from a potential attack.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: The Board of Directors oversees risks relating to cybersecurity. The CISO presents to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. The CISO has overseen the Company's information security program for the last 15 years. He holds a Bachelor of Arts degree in Business Administration, and has over 30 years' total experience in the information technology and security field, including various leadership roles before joining Wynn Resorts. In addition, he holds several industry technical certifications in information security, network engineering, systems engineering, database management, application development, and security intrusions.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: Our global information security program, led by our CISO, includes dedicated teams specialized in (i) identity access management, (ii) data protection, (iii) incident response, (iv) vulnerability governance, (v) security operations and engineering (vi) governance, risk, and compliance, and (vii) insider risk and intelligence. The members of the information security team are responsible for managing, maintaining, and monitoring the systems and processes that prevent, detect, mitigate and remediate cybersecurity incidents, and for informing our CISO of status of such systems and processes, as well as any significant incidents.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information systems.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We have established processes and policies for assessing, identifying and managing material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework and include a Cybersecurity Incident Response Plan ("CIRP"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: The Company's CIO has over 20 years of experience in the field of technology and security and is instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies. The internal IT team is responsible for the day-to-day implementation of the Company's cybersecurity risk management programs, testing compliance with standards, remediating known risks, and leading employee training programs. The team monitors the latest developments in cybersecurity, including potential threats and innovative risk management techniques, to help prevent, detect, and mitigate cybersecurity incidents.

companyName: Energy Services of America CORP

ticker: ESOA


text: The Bank's information security program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.

companyName: BCB BANCORP INC

ticker: BCBP


text: Our Audit Committee receives periodic updates from management of our cybersecurity program and risks, including, as necessary, any material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. Members of our Audit Committee are also encouraged to engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. The Committee reports to the full Board of Directors regarding its activities and risk management functions, including those related to cybersecurity.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess, identify, and manage material risks from cybersecurity threats and incidents, as described above under "Cybersecurity Risk Management and Strategy." The CISO has served in this role since October 2024, and has over 20 years of professional experience in identifying, evaluating, and responding to cybersecurity threats and incidents. Our CISO holds a Bachelor of Science degree from DeVry University, Addison, Illinois, a Masters in Business Administration from Western Governors University, is a Certified Information Systems Security Professional (CISSP), a GIAC Certified Incident Handler (GCIH), and holds a GIAC Certification in Strategic Planning, Policy and Leadership. Members of the Crisis Response Team have extensive work experience in systems and programming, auditing, compliance and privacy laws, financial controls and procedures, and operations management. With the assistance of the CISO, along with our internal cybersecurity and information technology professionals and our third-party cybersecurity consultants and advisors, the Crisis Response Team is charged with the responsibility of preventing, detecting, mitigating, and remediating cybersecurity threats and incidents.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results and evolving industry practices. The Company also publishes attestations of its various certifications, audits, and penetration tests on its global compliance webpage.

companyName: Salesforce, Inc.

ticker: CRM


text: Risk Management and Global Strategy We have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard. Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: The Company engages third-party consultants to conduct periodic penetration testing designed to identify potential security vulnerabilities. The Company's internal audit function, which has been outsourced to an international accounting firm, conducts periodic audits of cybersecurity and reports on such matters to the Audit Committee of the Board of Directors.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: As of the date of this Report, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: –a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and –a third-party risk management process for service providers, suppliers, and vendors.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: We maintain procedures and processes designed to evaluate and respond to certain identified risks. We assess potential adverse impact across a variety of factors, such as financial, product roadmap, brand and reputation, operational performance, and our ability to comply with applicable laws and regulations. Potential responses for cybersecurity risks are: • Avoiding activities or situations that could lead to harm. • Engaging in preventative measures, safety protocols, and security enhancements. • Transferring risk through contract or insurance. • Developing contingency plans to address potential negative outcomes associated with cybersecurity risks if they occur.

companyName: Everpure, Inc.

ticker: PSTG


text: For a discussion of risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" under the heading "Cybersecurity and Data Privacy Risks." (Part I, Item 1A of this 2023 Form 10-K).

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A - Risk Factors.

companyName: SMITH A O CORP

ticker: AOS


text: As required by federal banking laws and regulations, the Bank's cyber/information security risk management practices include risk assessments, controls and practices specifically for cybersecurity, information technology deployment and third-party information technology vendor risk management.

companyName: BankFinancial CORP


text: At this time, we have not identified any risks from known previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. With a majority of our business in energy and infrastructure, we face sophisticated and rapidly evolving attempts to overcome our security measures and protections. The occurrence of both intentional and unintentional incidents could occur in the future. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, and technology disruptions and failures, our reliance on technology.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Cybersecurity Risk Management and Strategy PriceSmart has developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical technology systems, data and information. We have implemented processes and protocols designed to monitor, identify, mitigate and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Cybersecurity represents an important component of our overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment.

companyName: PRICESMART INC

ticker: PSMT


text: The Company engages with third party cybersecurity specialists to provide an independent assessment of U. S. Steel's cybersecurity programs and to prepare a 5-year plan to maintain compliance and operational excellence. Management periodically reviews the 5-year plan and modifies it in response to changes in the threat landscape and otherwise as needed. Management employs in-depth defense mechanisms throughout the enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and table top exercises to mitigate and/or prevent cybersecurity incidents. The Company conducts security assessments of certain third party providers before and periodically throughout their engagement and has established procedures intended to mitigate risks related to security incidents originating from third parties. For example, management assesses the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of new cloud computing services.

companyName: UNITED STATES STEEL CORP


text: Our Director of Information Technology and the Information Technology team are primarily responsible for assessing and managing our material risks from cybersecurity threats. The collective team has extensive experience in information security and cybersecurity risk management, and they monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents on an ongoing basis using a combination of security tooling, automated systems and manual processes, including information technology log reviews from across teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.

companyName: GrowGeneration Corp.

ticker: GRWG


text: Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program. Our Executive Committee, made up of senior leaders across the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Detailed activities include: • Continuous Monitoring and Detection: Leveraging industry leading technologies to detect and alert on any suspicious activity across the enterprise to prevent and minimize cybersecurity attacks; • Information Security Assessments: Collaborating with internal and external partners to evaluate our data and network security; • Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess internal and external vulnerabilities and potential threats; • Cyber Risk Register Reviews: Regularly reviewing our internal risk register to remain fully informed and prepared to address potential and identified risks; • Risk Prioritization: Prioritizing and addressing risks through our dedicated cybersecurity risk management program and cybersecurity council; • Annual Third-Party SOC Reviews: Ensuring that our financially critical service partners maintain effective internal controls, including access controls, change management, backup, and disaster recovery planning; and • Tabletop Exercises and Event Simulations: Engaging all employees across the company to build awareness, education, and enhance our cyber response posture and the collective team decision-making processes. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: The Bank's CISO has held that position at the Bank since 2020 and has 30 years of experience in IT, including 18 years of experience in building and overseeing Information Security and Cybersecurity programs.

companyName: Federal Home Loan Bank of New York


text: Our Board is regularly involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects, stores and uses. Our principal objective for managing cybersecurity risk is to effectively identify and prevent or mitigate the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

companyName: Ameris Bancorp

ticker: ABCB


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. If such a communication is detected, it is subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. If our applications fail or our software does not successfully block a malicious electronic communication, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.

companyName: Investview, Inc.

ticker: INVU


text: The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity evaluation and recommendations established by the Information Security Department are reported to the Risk Management Council no less than quarterly, and the results are then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk. See "Risk Management" in section of MD&A for an overview of our risk management framework.

companyName: FNB CORP/PA/

ticker: FNB


text: in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of our CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs," "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches," and "Failure of our information technology systems could significantly disrupt the operation of our business.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: Our cybersecurity and physical security controls are implemented through policies and procedures which form the comprehensive framework we utilize for planning, performing, managing, assessing, innovating, and improving our security controls. Our defense-in-depth strategy to protect our cyber assets and sensitive information reduces the potential severity and duration of a cybersecurity incident by leveraging security measures across various layers of the enterprise. Cross-functional executive steering committees and peer groups, with business unit and technical stakeholder participation, are maintained to support oversight, security controls development, change management, implementation, evaluation, continuous improvement, and sustainment.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Key elements of our cybersecurity risk management program include regular and thorough risk assessments to identify potential cybersecurity threats across our operations, the implementation of appropriate multi-layered security controls and advanced monitoring systems, comprehensive employee cybersecurity awareness training and education programs delivered throughout the year. A key element of our cybersecurity response program is the regular and redundant point-in-time backup of critical configurations and files. The backup information is stored both locally and at off-site locations for additional security.

companyName: INFINITY NATURAL RESOURCES, INC.

ticker: INR


text: Despite our belief that we have a relatively low-risk cybersecurity profile and the minimal threat of cybersecurity incidents that we face, we contract with one IT Consultant to assist us in identifying any potential cybersecurity risks and in implementing and maintaining effective measures to reduce our cybersecurity risks. Our IT Consultant helps ensure that our system is updated with the latest cybersecurity patches and configurations and monitors our system and accounts for suspicious activity.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: Cybersecurity Governance AGM's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of AGM's Board of Directors ("AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. A GM's Board of Directors, AGM's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on AGM's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from AGM's risk management professionals, AGM's Chief Security Officer ("CSO"), the CISO, the AHL CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from AGM's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's Board of Directors and/or AGM's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or AGM's audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: Our cybersecurity risk management program includes: • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third party risk management process for service providers, suppliers, and vendors.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect employee and third party, including patient, information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and enhance our practices. We have developed an incident response policy which is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. Internally and through a third-party service provider, we regularly conduct tests on our systems and incident simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Verve Therapeutics, Inc.


text: Our CISO joined PTC as Cyber Information Security Officer in April 2022 and, before joining PTC, was the Vice President, Information Technology, North America and Europe for Alorica, where he led Alorica's transformation to a secure endpoint architecture for 90,000 global remote and hybrid employees.

companyName: PTC INC.

ticker: PTC


text: The Audit Committee is primarily responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: Blue Owl Capital Corp

ticker: OBDC


text: Our cybersecurity incident response process involves a multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders, including if appropriate the audit committee and the board, and keeping them informed and involved as appropriate. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, we have experienced incidents that did not have a material impact on our business or operations, and there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: Perception Capital Corp. IV


text: We assess, identify and manage risks from cybersecurity threats through our Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors (the "Audit Committee") and is managed by our Chief Information Officer ("CIO") and a dedicated Chief Information Security Officer ("CISO"). The CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network, and, information assets. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial N.V.

ticker: CNH


text: The Audit Committee receives reports from management on our cybersecurity risks, typically at least twice per year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program.

companyName: Callaway Golf Co

ticker: CALY


text: Our CISO works in coordination with our senior management and leaders at each of our brands to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our CISO and the internal security team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate. We also use a Managed Security Service Provider (MSSP) to provide continuous monitoring of our systems and supplement our internal security team.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our IRP contains detailed processes and procedures to assist employees in managing cybersecurity incidents when they happen, including techniques for detecting/identifying suspicious activity in our data environment, response and escalation protocols to defend against intrusions and contain any potential data leakage, data preservation measures to ensure data integrity going forward, and remediation steps to diagnose root causes and secure gaps to prevent future attacks.

companyName: ContextLogic Inc.


text: Oversight of cybersecurity risk involves a three-tiered hierarchy designed to leverage the appropriate level of expertise to assess and manage such risks. This consists of our Chief Information Security Officer ("CISO"), Security Governance Committee ("SGC") and the Audit Committee of the Board. Our CISO is primarily responsible for our global information security program. In this role, the CISO is responsible for the effective operations of information security controls and management of information security and cybersecurity risks across the enterprise, including within our products and operations. The CISO also aligns our information security strategy with our business and technical strategies and integrates, where possible, security initiatives into roadmaps of other functions to promote accountability and awareness. The CISO is also responsible for developing and implementing our information security policies and standards in accordance with applicable global regulatory requirements and facilitating updates to these policies and standards at least annually. Our CISO has 20 years of global information security leadership experience across financial services, legal and medical device industries and over 35 years of broader IT experience.

companyName: QuidelOrtho Corp

ticker: QDEL


text: We recognize that risk management is an integral part of achieving our organizational goals, enhancing stockholder value and increasing the likelihood of long-term corporate success. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall Enterprise Risk Management ("ERM") program. We maintain a strong cybersecurity program to protect not only our business, but also our clients, vendors and employees. We have a dedicated Information Security function ("Infosec") that oversees the company's cyber risk management and strategy.

companyName: Thoughtworks Holding, Inc.


text: Our cybersecurity program uses layered security defenses, cyber resiliency and automation capabilities for our security functions and operations. Our cybersecurity roadmap outlines and defines the security initiatives, projects and tasks. Security investments and projects are discussed by the Security Steering Committee ("SSC").

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Our information security program is still in its early developmental stages and an ongoing process. As a smaller organization, we are actively refining our information security program to more effectively address cybersecurity risks and threats. Our primary objective is to improve our ability to effectively identify, protect against, detect, and respond to potential cyber threats across all aspects of our operations.

companyName: META MATERIALS INC.


text: We have implemented a Threat Intelligence function that informs of external cyber threats which allows us to proactively protect the Company and to allow us to improve the speed of our vulnerability management capabilities.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Next, we perform certain controls and processes in order to Protect against the identified risks. In connection with this phase, we do the following: • Maintain controls and processes over access to our networks and computer systems including: (i) approval and restriction to appropriate personnel as well as ensuring powerful privileges are restricted and segregated to select information technology employees; (ii) utilize a password manager to protect encrypted passwords of power users; (iii) disable system and physical access of terminated employees in a timely manner; (iv) utilize two-factor authentication for remote access to the network; and (v) segregate internal network through the use of internal firewalls; • Maintain physical security at our data center and backup recovery location including door access control system at the primary data center with surveillance; • Block data intrusion to maintain confidentiality and integrity of our data via the following: (i) capacity of our servers and networks have an automated monitoring system; (ii) patch management controls on our key software including monitoring resources for patch criticality and reported issues as well as running vulnerability scans; (iii)

companyName: FIRST INDUSTRIAL LP


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Investment Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. In addition, the CISO provides regular briefings for our Board of Trustees and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Trustees and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.

companyName: Franklin BSP Real Estate Debt BDC


text: Our Cybersecurity Committee also reviews cybersecurity incidents affecting our third party service providers as necessary. Upon being notified of an incident having occurred at a third party, our Vice President of IT or a designated point of contact will promptly contact the third party to understand the details and scope of the event. An initial report outlining the nature of the incident, affected systems, and preliminary impact assessment will be provided to the Cybersecurity Committee which will convene to review the matter. Regular communication is to be maintained with the third party with updates provided to the Cybersecurity Committee to enable appropriate steps to be taken and timely public reporting if needed.

companyName: Celsius Holdings, Inc.

ticker: CELH