text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is based on principles set forth in the Secure Controls Framework (SCF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the SCF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: We have not experienced a material cybersecurity breach as an organization in the past five years. Moreover, cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures to address and mitigate cybersecurity threats, there can be no assurances that such an incident will not occur despite our efforts, as described in Item 1A. Risk Factors.

companyName: Pennant Group, Inc.

ticker: PNTG

secItem: Item 1C


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Privacy and Security Subcommittee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: We do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We depend on the digital technologies of third parties, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. As a company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Planet Green Holdings Corp.

ticker: PLAG


text: Our CSO, who assumed his current role in 2022, has over 10 years of cybersecurity experience with us and over 27 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer ("CIO"). Our CIO, who assumed his current role in 2011, has 34 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system's IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense's military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors' Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.

companyName: Encompass Health Corp

ticker: EHC


text: The Audit Committee is central to the Board's oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective, receives regular reports from the Chief Information Security Officer and other third party advisors, to assure the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: A consistent and holistic approach to cybersecurity is important to achieving our strategic business objectives and protecting our intellectual property. Because we sell many of our products through e-commerce platforms, we would be indirectly affected by a variety of cybersecurity threats such as ransomware and denial-of-service attacks that affect most industry sectors. Our customers, suppliers and other business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. We are continually evaluating best practices and methods to protect us from a wide range of potential threats.

companyName: HEALTHY EXTRACTS INC.

ticker: HYEX


text: The Director of IT Operations has served in various roles in information technology and security across multiple industries for over 35 years. In addition, the Company retains qualified employees and engages consultants with significant expertise and certifications in cybersecurity relevant to our industry. The Company's CEO, CFO, and CLO each hold degrees relevant to their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Telesis Bio Inc.


text: PRC subsidiary has established Information Security Committee and appoints the CEO, Mr. Guolin Tao to be the head of the committee;

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Vistra's Chief Information Officer (CIO) ensures Information Security is built into the Company's larger technology strategy and oversees our Chief Information Security Officer (CISO). Our CISO and his Information Security team are responsible for leading the enterprise-wide information security strategy, policy, standards, architecture, and processes. Additionally, our Cyber Incident Response Teams under the CISO are responsible for monitoring and analyzing the Company's cybersecurity posture in partnership with Risk and Legal.

companyName: Vistra Corp.

ticker: VST


text: Our board of directors has oversight responsibility for risk management, which it administers directly and with assistance from its committees, primarily the audit committee. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees information to manage and defend against the most relevant and prevalent cybersecurity risks to AbbVie. We also provide specialized training for employees in specialized information technology roles and for business functions who may be impacted by a cyber incident. We conduct regular drills, such as tabletop exercises, to help with our overall preparedness.

companyName: AbbVie Inc.

ticker: ABBV


text: The Board of Directors oversees the risk management process, while executive leadership implements risk mitigation and cybersecurity strategies. The company's cybersecurity strategy is actively overseen and guided by the Board of Directors through a quarterly subcommittee meeting with the full Board engaged annually. Executive management provides cybersecurity and risk management updates to the Board through the Risk Committee and the Technology Steering Committee. Information Technology knowledge is considered a core competency by eight of eleven Board members. They guide the full Board in setting cybersecurity objectives, approving policies, and allocating resources.

companyName: MID PENN BANCORP INC

ticker: MPB


text: As cybersecurity incidents occur, the GM Cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, the Cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.

companyName: General Motors Co

ticker: GM


text: Integrated Risk Management The Program is integrated into the Company's enterprise risk management framework and functions to identify risk, form a strategy to manage risk, implement the strategy, test the implementation, and monitor our technology environment to control risk. The information technology team works closely with stakeholders across security, risk, compliance, operations, other business stakeholders, and senior leadership to conduct an annual cybersecurity risk assessment utilizing the FFIEC Cybersecurity Assessment Tool.

companyName: F&M BANK CORP

ticker: FMBM


text: See "Information Security, Cybersecurity, and Data Privacy Risks" in Part I, Item 1A, Risk Factors for additional information regarding risks from cybersecurity threats.

companyName: TARGET CORP

ticker: TGT


text: Each business unit's Chief Information Security Officer ("CISO") on at least an annual basis is to provide a report to the Company's senior management, regarding the state of their cybersecurity program and its material cyber risks.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Vado Corp.


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from dual-primary data centers in the cloud, with one located in the Eastern U.S. region and the other in the Western U.S. region. Either site alone is capable of running all of our essential systems. In addition, we maintain technology operations in East Asia, the Western U.S. and the South Central U.S. regions. Replicated instances of this technology are maintained in our Eastern U.S. region. All regions are built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards. Failover for the majority of our systems is automated.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to our information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees and contractors with access to the Company's network. In addition to the annual security training requirement, employees participate in monthly phishing tests, and where appropriate, additional security awareness follow-up training in response to such tests. Training is supplemented through periodic Company communications encouraging all employees and contractors to promptly report security events, incidents and abnormal system behavior.

companyName: GoHealth, Inc.

ticker: GOCO


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, see "Risks Related to Operations, Technology Systems, Accounting and Internal Controls" in Item 1A. Risk Factors which is incorporated by reference into this Item 1C.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Our CSIRT includes our independent outside cybersecurity consultant as our strategic lead and the consultant and Chief Financial Officer (CFO) lead the Incident Response Team. Our consultant is certified in cybersecurity and our CFO has overseen our IT for over twenty years.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Our cybersecurity team regularly updates the Audit Committee of the Board on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.

companyName: Pactiv Evergreen Inc.


text: The Audit Committee receives reports from management regarding the Company's assessment of the cybersecurity risks, and other risks, on an annual basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports regularly to the full Board regarding its activities, including those related to cybersecurity.

companyName: ESCALADE INC

ticker: ESCA


text: Furthermore, at the Board meetings at which our Vice President, Information Technology or other members of our information technology group do not provide in-person updates to the Board, our CEO or another executive team member provides current updates to the Board. In addition, our information technology group provides updates to the full Board upon request, or timely updates regarding unique developments such as regulatory updates or vulnerability developments. Our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that equips them to oversee cybersecurity risks effectively.

companyName: LGI Homes, Inc.

ticker: LGIH


text: Our Information Technology personnel responsible for cybersecurity risk assessment and management processes are managed by certain members of our executive management, including our Chief Financial Officer. Together with our executive management, our Information Technology personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. We seek to hire information technology personnel with skills appropriate to help us prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.

companyName: GERON CORP

ticker: GERN


text: Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: VERACYTE, INC.

ticker: VCYT


text: Additionally, our cybersecurity risk management processes include review and assessment by external, independent third parties, who assess the maturity of our cybersecurity program and identify areas for continued focus and improvement. Furthermore, our Legal Department advises the Board about best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: In particular, our Senior Vice President of Innovative Technology Solutions ("SVP-ITS") is responsible for our overall technology strategy, including overseeing our information security function and plays a pivotal role in assessing and managing all cybersecurity risks, threats, and incidents. The SVP-ITS reports directly to our President and Chief Operating Officer ("President and COO") and maintains regular dialogue with our President and COO and other key members of our senior management to ensure these individuals are appropriately apprised of our latest cybersecurity posture and developments, such as new threats, incidents, risks, and risk management solutions. Our SVP-ITS prepares reports for each regular Board meeting regarding significant developments in these topics to support the Board in its efforts to have appropriate information to exercise oversight on critical cybersecurity issues. Our current SVP-ITS has decades of experience overseeing leading systems and software development efforts with critical cybersecurity components.

companyName: INSPERITY, INC.

ticker: NSP


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include regular risk assessments and control testing conducted at least annually or whenever there are material changes to our systems or operations.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: We have experienced cybersecurity incidents in the past and will experience cybersecurity incidents in the future. Prior cybersecurity incidents have not materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition; however, there is no guarantee that a future cybersecurity incident would not have a material adverse effect on such items. While our cybersecurity program is designed to mitigate cybersecurity risks, we cannot eliminate all risks from cybersecurity threats. See Item 1A. Risk Factors for more information on our cybersecurity risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Communication, Coordination and Disclosure: The Company promotes awareness and surveillance over cybersecurity risk at all levels of the organization, including staff, senior management and our Board of Directors.

companyName: Farmland Partners Inc.

ticker: FPI


text: Our cybersecurity program is led by our Vice President of Information Security and overseen by our Chief Information Officer ("CIO"). Our Vice President of Information Security, who is responsible for assessing and managing our information technology risks, including cybersecurity, joined Winnebago Industries in July 2021 and has over 25 years of experience in heavily regulated industries such as finance and healthcare. She has held multiple roles in Information Security and IT, demonstrating expertise and versatility in navigating the threat landscape of cybersecurity. Our CIO reports to our Senior Vice President, Chief Financial Officer, a member of our senior leadership team who reports to our President and Chief Executive Officer.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: Significant incidents are reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as being or becoming potentially material is promptly escalated for further assessment and reported to designated members of senior management. Senior management is responsible for assessing the materiality of an incident, complying with any regulatory requirements, and communicating relevant information to the Audit Committee, as appropriate. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters.

companyName: Xperi Inc.

ticker: XPER


text: Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program defines key risk objectives and if cybersecurity risk exceeds defined thresholds, risks are documented and escalated into the enterprise risk program and Blend's internal audit team. We require all third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices via contractual obligations that are entered into in connection with as a mandated review prior to engaging such service providers. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data at the time of termination of the contract.

companyName: Blend Labs, Inc.

ticker: BLND


text: In the past we were subject to attempts to compromise our information technology systems, and, like all information technology systems, our systems are potentially vulnerable to damage, unauthorized access, or interruption from a variety of sources. As of the date of this annual report on Form 10-K, we are not aware of any such attacks that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. In addition, our third-party service providers and other partners face similar cybersecurity threats, and although we assess these third parties' cybersecurity controls through a cybersecurity assessment, which may include a cybersecurity questionnaire depending on our risk evaluation, and include security and privacy addendums to our contracts where applicable, a cybersecurity incident any of these entities could materially adversely affect our business and results of operations. For more information on our cybersecurity-related risks, please see "Risks Related to Information Corporate Governance Cybersecurity Risks Oversight by the Members of our Board

companyName: DNA X, Inc.

ticker: SONM


text: The CISO leads Abbott's cybersecurity strategy and program and its cybersecurity and privacy incident response team that is responsible for monitoring the detection of cybersecurity incidents and executing Abbott's cybersecurity incident response process, as needed. Pursuant to the process, the team is responsible for the investigation and resolution of cybersecurity incidents, including reporting to an Abbott senior management-level committee on detection, mitigation, and remediation of significant cybersecurity incidents. The CISO reports to the CIO, who has overall responsibility for the cybersecurity program and organization.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: Board of Directors Our board of directors is responsible for general oversight and regular review of information regarding our risks, including cybersecurity risks. Members of management communicate an overview of our current cybersecurity environment to our board of directors at least annually and provide updates to our board of directors regarding cybersecurity matters periodically throughout the year. Additionally, our third-party auditors inform the audit committee of our board of directors of our ITGC framework and control testing results, which include controls related to cybersecurity risks. Further, management has established cybersecurity incident response processes for escalating the communication of cybersecurity incidents up to the board of directors, as appropriate.

companyName: LeonaBio, Inc.

ticker: LONA


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires are also required to receive training in the form of drills and simulated attacks.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as software-as-a-service providers whose products are used to store our data, including through review of System and Organization Controls ("SOC") reports prior to onboarding.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We could be held liable for damages, our reputation could suffer, and our business may be materially impacted due to service interruptions from security breaches, cyber-attacks, other cybersecurity events or incidents or disclosure of confidential information or personal data."

companyName: DXC Technology Co

ticker: DXC


text: To date, Lucid is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Lucid, including our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" of this Annual Report for further information about our cybersecurity risk.

companyName: Lucid Group, Inc.

ticker: LCID


text: We identify and address cybersecurity risks associated with key third-party service providers through security and privacy assessments prior to engaging these third parties, the breadth of which is determined by factors such as the type of data, if any, the third party will have access to, whether the third party will have access to our networks and systems, and whether the third party will provide hardware or software to be used in our products or elsewhere in our organization. Depending on the results of these assessments, we may conduct further assessments prior to or periodically throughout the course of our engagement limit or cease plans to engage the third party, or negotiate specific contractual protections or remediation provisions.

companyName: QuidelOrtho Corp

ticker: QDEL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal data of employees and others ("Information Systems and Data").

companyName: Longboard Pharmaceuticals, Inc.


text: In addition, management of cybersecurity threats is shared with the chief information officer who is responsible for the Companies' technology assets including hardware, software, networks, servers and telecommunications. The chief information officer has over 25 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management. In addition, the chief information officer previously served on the board of the Virginia Cybersecurity Partnership, a collaboration between private industry and the Federal Bureau of Investigation.

companyName: VIRGINIA ELECTRIC & POWER CO


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate to take.

companyName: China Foods Holdings Ltd.

ticker: CFOO


text: Our information security team is led by our Director of Information Security and Privacy, who has decades of experience in information technology and cybersecurity. Furthermore, our Director of Information Security and Privacy holds a number of certifications, including CISSP (Certified Information Systems Security Professional) and CCSP (Certified Cloud Security Professional). The information security team conducts periodic assessment and testing of our policies, standards, processes, and practices that are designed to address a multitude of potential cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, adoption and regular evaluation of incident response plans and procedures, regular team member email phishing test campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, team member cybersecurity awareness programming, regular audits & evaluations of internal and third-party systems, and continuous improvement of the information security management system.

companyName: INSEEGO CORP.

ticker: INSG


text: We have an incident reporting and escalation process that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Company's senior leadership, which based on the circumstances, may include executive officers and representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") of significant or material cybersecurity incidents, as appropriate.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CFO, COO and CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.

companyName: IN8BIO, INC.

ticker: INAB


text: Our information systems consist of computer systems used by the Company's Chief Executive Officer and chief financial officer. They actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats they discover or that are reported to them, and reports and services that identify threats. They monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: The business continuity program is overseen by the Business, Operations, and Technology Committee of the Board and includes business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Enterprise Risk Management Committee is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the Board.

companyName: Federal Home Loan Bank of Cincinnati


text: During the period covered by this report, the risk from cybersecurity threats or incidents did not have a material impact on our strategy, results of operations, or financial condition. It is inevitable that cybersecurity incidents will occur in the future and any such cybersecurity incident may result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of data, as well as the likely extent and effect of lost revenue, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Chicago


text: There is strong engagement in risk management from company leadership, including the CEO, executives and senior leaders. The ERM program is driven by Vontier's Executive Risk Committee, which is led by the SVP, Chief Administrative Officer and comprised of business and functional leaders. Our Audit Committee oversees the ERM program and the Board of Directors have regular updates on topics that are identified through the RAP and overall risk management process.

companyName: Vontier Corp

ticker: VNT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Manager, who has worked in various roles responsible for securing networks, hardware, and other application systems, Chief Financial Officer, and Chief Accounting Officer.

companyName: NETSTREIT Corp.

ticker: NTST


text: Employee Training and Awareness Recognizing the importance of human factors in cybersecurity, the Company invests in employee training and awareness programs. Our efforts are particularly focused on common threats like phishing attacks, and we are planning to introduce a comprehensive cybersecurity awareness and prevention program beginning in 2024.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across the Company. Further, we may engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to the Company are brought to the attention of both the Chief Enterprise Technology Officer and General Counsel by the Chief Information Security Officer as part of our cybersecurity incident response processes.

companyName: FORD MOTOR CO

ticker: F


text: Despite our cybersecurity processes and risk mitigation strategies and practices, the threat landscape has become increasingly sophisticated and aggressive. While we have not experienced any material cybersecurity threats or incidents to date, there can be no assurance that a future cybersecurity incident would not have a material adverse effect on our cash flows, financial condition or results of operations. Additional information on cybersecurity risks we face can be found above under "Item 1A - Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Coeur Mining, Inc.

ticker: CDE


text: Members of our board of directors may also engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: G1 Therapeutics, Inc.


text: Our Board, in coordination with the Audit Committee, is actively engaged in reviewing management's processes for assessing and managing cybersecurity risks. The Board reviews cybersecurity at least annually. The Audit Committee directly oversees the Company's management of cybersecurity risks. On a quarterly basis or as needed, the Audit Committee receives updates from management (including the CIO and CISO) on cybersecurity risks resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. In addition, the Chair of the Audit Committee regularly informs the Board of the outcome of the Audit Committee's reviews at scheduled Board meetings.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: The Board, the Audit Committee and management each actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Audit Committee regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer ("CISO") and other members of management to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.

companyName: Wheels Up Experience Inc.

ticker: UP


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that would provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: STORE CAPITAL LLC


text: In the future we may be required to expend additional resources to continue to enhance information security measures to investigate and remediate any information security vulnerabilities. We can provide no assurances that the measures we have implemented to prevent security breaches and cyber incidents will be effective in the event of a cyber-attack.

companyName: Target Group Inc.

ticker: CBDY


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: DIH HOLDING US, INC.


text: Although the Company has put in place the cybersecurity policies, procedures and processes described above, the Company remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition. As of the filing of this Form 10-K, we are not aware of any attacks, incidents, misuse or manipulation that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. For risks associated with cybersecurity threats, see the risk factor "The Company relies extensively on information technology (IT) systems to conduct its business. Interruption of, damage to or compromise of the Company's IT systems and failure to maintain the integrity of customer, colleague or Company data could harm the Company's reputation and have an adverse effect on the Company's business, financial position, results of operations and cash flows." included in "Part I—Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: STEPAN CO

ticker: SCL


text: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.

companyName: KORN FERRY

ticker: KFY


text: For additional information regarding risks related to cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Failure to comply with laws and regulations relating to privacy, data protection, and cybersecurity could lead to government enforcement actions, private litigation and adverse publicity."

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We identify and address information security risks by employing a defense-in-depth methodology that provides multiple, redundant defensive measures in case of security control fails or a vulnerability is exploited.

companyName: POTBELLY CORP

ticker: PBPB


text: Our information technology management team, along with our externally managed security operations center, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes background in cybersecurity and information technology operations, with a focus on cybersecurity, data privacy, information technology governance, and risk management. The team is proficient in conducting vulnerability assessments, analyzing security logs, and implementing necessary security controls, with knowledge in cloud technologies and computing, database management, DevOps, and quality engineering.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above Governance

companyName: New Mountain Guardian IV Income Fund, L.L.C.


text: Our Audit Committee, composed of members of our Board of Directors, oversees risks from cybersecurity threats and our cybersecurity risk management program as an integrated part of our overall risk management processes. We conduct quarterly assessments to identify and evaluate cybersecurity threats and present our findings to the Audit Committee. In consultation with the Disclosure Committee, we also notify the Audit Committee about cybersecurity incidents and risks related to cybersecurity incidents. The Audit Committee is responsible for advising the Company on appropriate incident response steps.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: As part of its risk-based strategy, the Company maintains appropriate technical and organizational measures and regularly reviews the appropriateness of those controls considering changes to the technical or regulatory environment. The Company also regularly incorporates cybersecurity awareness training into employee communications, engagement and training activities. The Company participates in various information sharing organizations to timely share and receive threat information, thereby improving the collective defense of the aviation and other critical infrastructure sectors. The Company regularly seeks opportunities to improve its capabilities, including through cybersecurity trainings and skill development programs for its CDR members.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk assessment and our information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that we believe are more likely to lead to a material impact to our business. In addition, our senior management evaluates material risks to the Company, including material risks from cybersecurity threats against the Company's overall business objectives and reports to the audit committee of our Board, which evaluates our overall enterprise risk and related management of such risk.

companyName: Akili, Inc.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication requirement has been implemented for employees and third parties accessing sensitive company information.

companyName: Enviva, LLC


text: The key components of our cybersecurity program will include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;

companyName: Onconetix, Inc.

ticker: ONCO


text: Governance of Cybersecurity Management Our cybersecurity governance structure is specifically designed to provide a clear chain of responsibility and accountability for assessing, managing, and mitigating cybersecurity risks. The Vice President of Information Security, who reports directly to the Chief Technology Officer ("CTO"), a member of our Executive Committee, leads our cybersecurity initiatives. Together, the Vice President of Information Security and the CTO bring a combined 50 years of technology experience with over 20 years dedicated to IT and security leadership. The Vice President of Information Security is tasked with overseeing cybersecurity risk assessments, implementing strategic security initiatives, and ensuring alignment with evolving regulatory requirements. The Vice President of Information Security provides weekly briefings to the CTO. Additionally, the Vice President of Information Security presents updates to the Executive Committee and the Board of Directors at least annually, although these updates generally occur on a quarterly basis. These presentations cover critical security issues and significant emerging threats.

companyName: Inotiv, Inc.

ticker: NOTV


text: Management holds monthly Information Security Management System (ISMS) meetings which include members of the executive management team as well as the CIO and other key individuals reporting to the CIO. Cybersecurity risks, threats, and vulnerabilities, as well as existing mitigating controls, are discussed in ISMS meetings. Our CIO also provides quarterly reports of our information security program, as well as any material cybersecurity risks, to the board of directors.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday's business strategy. Additionally, the Board has delegated to its Audit Committee oversight of cybersecurity risks and processes to manage them. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.

companyName: Workday, Inc.

ticker: WDAY


text: Prior to the consummation of our business combination on February 2, 2024, we were a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating acquisition transaction candidates that meet our investment criteria. Therefore, we do not consider that we face significant cybersecurity risk. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Solidion Technology Inc.

ticker: STI


text: Prevention of denial-of-service attacks • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents. • Policies and procedures related to cybersecurity matters, including but not limited to Acceptable Standards of Use of Technology Systems, Confidential/Sensitive Information and Credit Card Handling Policy, encryption standards, antivirus protection, wireless and remote access, multi-factor authentication, access and change control, and physical security. • Employee cybersecurity awareness by performing ongoing phishing exercises, and mandatory privacy and cybersecurity training (including spear phishing and other awareness training) for employees.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Related to Cybersecurity Risks We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.

companyName: SWK Holdings Corp

ticker: SWKH


text: We have developed and implemented processes for identifying, assessing, and managing cybersecurity risks as part of our overall enterprise risk management program. These processes are designed to protect our information technology and operational systems against cybersecurity threats. In connection with the operation of our program, we take into consideration guidance from various recognized cybersecurity industry frameworks and standards such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the International Organization for Standardization ("ISO") 27001 standards. This does not mean that we adhere to any particular frameworks or meet any particular standards, but rather that we use industry frameworks and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risk is collected as part of our overall enterprise risk management program, including as part of the annual enterprise risk assessment survey conducted by our internal audit team, the results of which are summarized and provided to our Audit Committee.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: Training and education - We require employees and contractors to complete data protection and security awareness training in connection with onboarding and annually thereafter. These trainings cover a wide range of topics, including, but not limited to, ransomware, impersonation attacks, data handling and privacy, fraud, phishing, and identity theft. We conduct phishing simulation tests during the year to educate, train, and assess our employees' ability to identify malicious emails and employees who do not follow our protocol are provided with additional follow-up training. From time to time, we also require supplemental training depending on an individual's role or job responsibilities. Our CISO also periodically presents on cybersecurity matters at company-wide meetings and with individual business and corporate functions.

companyName: Dynatrace, Inc.

ticker: DT


text: Our cybersecurity program is designed to align with industry standards and best practices for similarly situated companies in our industry and at our stage of development, and includes benchmarking against standards such as the National Institute of Standards and Technology Cybersecurity Framework (the NIST CSF). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through periodic vulnerability scans, penetration tests and threat intelligence feeds. We use various tools and methodologies to manage cybersecurity risk that are tested on a periodic cadence.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. The ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's information security risk management program controls, including management's assessment of recent information security incidents meeting certain criteria.

companyName: CoreCivic, Inc.

ticker: CXW


text: Roles and Responsibilities Roles and responsibilities for cybersecurity have been established first by VanEck's cybersecurity policy and secondly by its connection to the governance structure of the firm and VanEck's risk management committee (the "Risk Management Committee"), which is comprised of senior-level employees.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: The Vice President and Chief Information Security Officer (CISO) leads the global information security organization responsible for overseeing our information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies, and is a Certified Information Security Professional and Information Systems Security Architecture Professional. Team members who support our information security program have relevant educational and industry experience, including having held similar positions at large technology companies. Given the nature of our business, management is highly focused on identifying and managing cybersecurity risks, and our CISO and information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.

companyName: AGILYSYS INC

ticker: AGYS


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Company's risk management framework and processes. We employ a variety of processes, risk assessments, and controls to assess, identify, and manage these risks and have developed and maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity. Trusted partners are an important part of our cyber risk management program. We partner with service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.

companyName: INTEGRATED BIOPHARMA INC

ticker: INBP


text: We perform due diligence regarding our third-party suppliers, service providers and other business partners. This may include requiring evidence demonstrating third parties' ability to meet our cybersecurity and data handling requirements. In addition, Peloton's business partners who process data are contractually obligated to notify us if they experience certain incidents impacting our or our Members' data. Our ability to monitor the cybersecurity practices of third parties is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, network or other cybersecurity assets owned or controlled by third parties.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: The Bancorp's Risk and Compliance Committee of the Board of Directors oversees the Bancorp's Enterprise Risk Management Framework and policies, including oversight of risks related to information security. The Risk and Compliance Committee receives periodic reports from the Technology Committee and these committees meet jointly at least once per year to discuss the Company's programs and risks.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: We maintain a comprehensive Information Security Management System ("ISMS") program, which is led by a dedicated Chief Information Security Officer ("CISO"), who joined the Company in April 2023 and has 25 years of extensive technical and SaaS experience, having served in roles of increasing responsibility relating to information security at other large public companies. Our CISO has undertaken a comprehensive review of our information security systems and processes, and as a result, we have made significant improvements to our cybersecurity controls and procedures over the last eight months, and expect to see additional incremental improvement in our cybersecurity risk management over the next six to twelve months.

companyName: Vimeo, Inc.


text: PACCAR maintains a comprehensive cybersecurity management and governance program, which includes the Company. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR FINANCIAL CORP


text: Our Board of Directors (the "Board") regularly considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents.

companyName: Consolidated Communications Holdings, Inc.


text: Mid Penn's Information Technology and Security management team is responsible for implementing and executing the company's cybersecurity strategy on a day-to-day basis. This team of cybersecurity experts specializes in managing risks for financial services providers. The Chief Information Security Officer has 20 years of experience and is accompanied by an Information Security Officer with eleven years of experience in the field. With more than 15 years of experience in information technology and network security, the Information Technology Operations Manager is highly skilled in network security and risk mitigation. Information Technology and Security management hold a monthly meeting to assess the organization's cybersecurity position and distributes information to the Board of Directors.

companyName: MID PENN BANCORP INC

ticker: MPB


text: Our information security policies and processes are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security and confidentiality of consumer information. We use various tools and strategies to identify and assess material risks from cybersecurity threats. We conduct ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing. The cybersecurity risk assessments, vulnerability testing, and penetration testing are designed to identify internal and external risks to the security of our information systems.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: We have not yet experienced any known material cybersecurity incidents. However, the lack of a formal cybersecurity risk management framework may expose us to vulnerabilities that could have an adverse effect on our operations, financial position, or reputation if not appropriately addressed in the future. We are currently evaluating the need for a more structured cybersecurity program and anticipate allocating resources to strengthen our risk management processes as we grow.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: JAKKS has implemented cybersecurity policies, processes and procedures to aid in the identification, protection, detection of cyber related issues, and the response to and recovery from cybersecurity breaches. A summary of the principal activities JAKKS has undertaken to strengthen its cybersecurity posture and mitigate its cybersecurity risks:

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") the oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: StandardAero, Inc.

ticker: SARO


text: Response and Recovery have a robust incident response plan in place to quickly detect, respond to, and recover from cybersecurity incidents. We collaborate with external cybersecurity experts and law enforcement agencies to enhance our incident response capabilities.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST, ISO and other standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Third-party service providers are used in various capacities as part of our cybersecurity risk management program, including performing risk mitigation controls and providing cloud-based cybersecurity services and platforms. For example, third-party service providers are used to conduct our external penetration testing, as well as assist the Company in detecting, responding, and mitigating cybersecurity incidents. The Company uses a variety of processes to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are required to complete a detailed questionnaire, which is used to identify and assess material cybersecurity risks. In addition, the Company performs an annual review of independent attestation reports of the third-party service providers' control environments designed to ensure that the controls meet Company security requirements and that any identified issues in the independent attestation reports do not present material cybersecurity risks to the Company.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the Company's cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from the CIO or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Further, our corporate audit function is responsible for assessing risk and testing whether, and the extent to which, our information security policies and practices are being implemented effectively within our business and by third party providers. Findings from such reports and related corrective action plans are shared with our CDT team, Company leadership, and the Audit Committee and Corporate Responsibility and Compliance Committee (CRCC) of our Board of Directors. In addition to leveraging the Company's own information technology resources, our Incident Response and Cyber Threat Intelligence teams engage, as needed, third-party cybersecurity risk assessors and consultants to assist in recognizing threats, identifying security vulnerabilities and evaluating the impact of cybersecurity attacks and incidents when they occur. On a biennial basis, our ATMOS also engages external third-party experts to assess the Company's cybersecurity control maturity across the organization and develops plans to address such experts' recommendations.

companyName: AMGEN INC

ticker: AMGN


text: We conduct quarterly assessments to identify cybersecurity threats. Based on these assessments, we design, implement and maintain risk-based controls to protect our information, our information systems and our business operations, address any identified gaps in existing controls, update existing controls, as necessary, and monitor the effectiveness of our controls. We have allocated adequate resources and have designated appropriate personnel, including our Global IT Senior Director, to manage the cybersecurity risk management process and engage with consultants, auditors, and other third parties in connection with our cybersecurity risk management process. Senior leadership, including our Global IT Senior Director who has extensive cybersecurity knowledge and skills gained from 20 years of work experience, is responsible for our overall enterprise risk management program and has integrated the cybersecurity risk management processes into the overall enterprise risk management program.

companyName: Whole Earth Brands, Inc.


text: Our Vice President of Information Technology also serves as our Chief Information Security Officer and is responsible for managing and implementing the Company's Information Security and Cybersecurity policy, which can be found on the Company's website. In addition, the Vice President of Information Technology sets company-wide control requirements, assesses adherence to controls, identifies and prioritizes cybersecurity risks, and oversees incident protection and response. The Vice President of Information Technology has over three decades of Information Technology experience overseeing cybersecurity as an integral part of the IT function.

companyName: TERAWULF INC.

ticker: WULF


text: Risk Management and Policies - Our policies, standards, processes, and practices for assessing, identifying, and managing risks, including material risks, from cybersecurity threats are integrated into our overall security and risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other applicable industry standards and best practices. We regularly review and update policies and procedures with input from IT and security leadership and industry security standards including PCI DSS and ISO. Business segments and local entities also maintain local policies and procedures that include global requirements and local, statutory, or contractual requirements and escalations. All employees must sign and acknowledge a Corporate Information Security Policy that outlines their responsibilities related to IT security, cybersecurity, and protection of company assets and data. In addition to the enterprise risk assessment presented to the Board, local entity IT and security teams maintain detailed risk assessments that are shared with local management and are provided for applicable regulatory requirements, as well.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: We have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality property, which is managed by unrelated third party property managers) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT I, Inc.


text: Our incident response plan identifies the key employees responsible for responding to a cybersecurity incident including our CIO, CLO, CEO, and other executives along with the technology department, and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The Company has not experienced incidents in the past which were material to our operating results or business.

companyName: HireQuest, Inc.

ticker: HQI


text: The CIO and CSIRT, in combination with the Senior Vice President, Chief Transformation Officer and CEO, play a pivotal role in informing the Audit Committee of the Board of Directors on cybersecurity risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of Board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: TENNANT CO

ticker: TNC


text: Testing and Validation We have incorporated multiple avenues of control and process testing and validation across the company. Our internal audit team regularly tests controls against established policies and standards. We leverage a trusted partner for performing regular penetration tests, to include phishing simulation exercises. Our IT and security team regularly conduct control validation exercises for each of the business units. We conduct regular incident response tabletop exercises to test and validate awareness of roles and responsibilities of incident responders across the organization and to educate individuals as to real world security incident scenarios.

companyName: Loar Holdings Inc.

ticker: LOAR


text: We have also established a cross-functional leadership team to oversee our information security and privacy programs and practices, as well as to assess, identify, manage and mitigate security and privacy risks. Members of this team also report periodically to the board of directors, audit committee, and members of our senior leadership team. This team includes senior leaders from our legal, privacy, information security, information technology, infrastructure, and compliance teams, including our Chief Privacy Officer, our VP, Business Foundations, our Head of Security, and our Chief Legal Officer. Our Chief Privacy Officer has held various roles advising Dropbox and two other large publicly-traded technology companies on a variety of privacy, regulatory, and product counseling issues since 2010. Our VP, Business Foundations has been with us since 2020, and has worked in the technology industry for over 20 years, working in product development, engineering, and security leadership and risk management roles over that time. Our Head of Security joined Dropbox in 2022 and has held roles in cybersecurity, engineering, and operations, including leadership positions, with a variety of companies for over 20 years. Our Chief Legal Officer has been with us since 2011, having served as our Chief Legal Officer or General Counsel for a total of over seven years, and has over 20 years of experience in the legal profession.

companyName: DROPBOX, INC.

ticker: DBX


text: We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Proto Labs Inc

ticker: PRLB


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see " Item 1A. Risk Factors."

companyName: TD SYNNEX CORP

ticker: SNX


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: Our dedicated information security organization leverages various frameworks for managing cybersecurity risks, including the National Institute of Standards and Technology ("NIST") framework. The key pillars of the NIST framework are to (i) develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (ii) develop and implement appropriate safeguards to ensure delivery of critical services; (iii) develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident; and (v) develop appropriate activities to action an incident.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: Our strategy is based around the identification, mitigation, avoidance and response to material cybersecurity risks. We employ physical and electronic safeguards to control access to our systems.

companyName: FONAR CORP

ticker: FONR


text: In 2024, there were no cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Cecil Pineda is our Chief Information Security Officer. Mr. Pineda has nearly 20 years of experience in the cybersecurity industry, having held senior IT security-related roles at nationally recognized companies and organizations. Mr. Pineda holds a degree in Electronics and Communications Engineering. He reports directly to Brian Gambs, our Chief Technology Officer. Mr. Gambs is an experienced leader with over two decades of expertise in managing cybersecurity risk for HIPAA-regulated entities, including payers and providers, and an extensive background in technology leadership for a publicly traded healthcare and financial services company. The other members of our Information Security Team have substantial cybersecurity experience, including cybersecurity incident response, mitigation and remediation; information security program design; and regulatory compliance.

companyName: R1 RCM Inc. /DE


text: The potential impact of risks from cybersecurity threats on the Trust are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Sponsor did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Sponsor, on behalf of the Trust, participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: The use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Chief Financial Officer will oversee our information security programs, including cybersecurity initiatives, and our cybersecurity incident response process. The Audit Committee of the Board oversees cybersecurity risk management activities, supported by our management, the Board of Directors, and external consultants. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: Wendy's is committed to securing our information systems against cybersecurity threats and protecting the privacy and security of our customers', employees', franchisees' and business partners' information. However, as described in "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's interconnected digital world and that, despite devoting considerable resources to secure our information systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Based on this recognition and taking into account experience from previous cybersecurity incidents, we have developed a comprehensive cybersecurity risk management strategy designed to identify, assess and manage potential threats to our information systems. Key components of our cybersecurity risk management strategy include the following: • CIS Controls. We design our cybersecurity risk management strategy based on the Center for Internet Security's ("CIS") Critical Security Controls Framework and other industry accepted standards and practices. The CIS is an internationally recognized, non-profit organization dedicated to developing controls, benchmarks and best practices for cybersecurity risk management. We conduct an annual assessment of our progress against the CIS controls to measure our performance against accepted benchmarks and identify ways to enhance our cybersecurity risk management strategy. The results of the assessment are reviewed by our Internal Audit team and shared with senior leadership and the Technology Committee of our Board of Directors. • Regular Risk Assessments. We conduct regular risk assessments to identify and assess material risks to our information systems, including as part of our enterprise risk management ("ERM") program, which is described in more detail under "Cybersecurity Governance" below. These risk assessments involve input from key stakeholders, including those with assigned accountability for managing risk and supporting technical risk subject matter expertise, and consider a variety of factors, including our global business strategy, operations and support, information systems and data assets. • Infrastructure. We design our cybersecurity infrastructure, including firewalls, endpoint security, intrusion detection tools and identity access management systems, to provide a multi-layered approach to protecting our information systems from unauthorized access, use, disclosure, disruption, modification or destruction. • Dedicated Personnel. We have several dedicated teams of cybersecurity specialists, including teams focused on executing internal and external vulnerability and penetration assessments, designing secure systems and applications, monitoring for intrusions and providing incident response. We have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions. • Training. We have an ongoing cybersecurity training program for designated employees and contractors which addresses, among other things, our cybersecurity risk management processes, overall cybersecurity awareness and industry cybersecurity best practices. This training program includes initial onboarding training, annual refresher training and periodic awareness assessments such as email phishing campaigns to test user awareness and defend against business email compromise.

companyName: Wendy's Co

ticker: WEN


text: We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties, as part of our overall risk-management efforts and program. In so doing, we consider the likelihood and impact that could result from the manifestation of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards to manage such risks. Identification: We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: We perform periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these evaluations.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: Material Cybersecurity Risks, Threats and Incidents The oil and gas industry has become increasingly dependent on information technology and operational technology to conduct certain processing activities. At the same time, cybersecurity incidents, including deliberate attacks or unintentional events, have increased. Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.

companyName: LandBridge Co LLC

ticker: LB


text: We proactively assess potential risks presented by new services or systems integrated with our network or data and ensure appropriate controls are applied under such circumstances. We have proactive security controls built into our software development life cycle that help engineers identify and resolve security issues at every stage of software development. Our identity verification processes, which include multi-factor authentication and other identity verification technologies, provide further protection for clients and customers. We perform due diligence and monitor third party relationships to assess the suitability of their cybersecurity controls and protocols based on risk profile for the business operations or services for which they are engaged.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: As part of the above process, we engage third-party services to provide 24-hour, 365-day monitoring, escalation, and response to cyber events. In addition to consulting on best practices, we leverage a third-party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Management's Role Managing Risk The CISO possesses more than 10 years of relevant expertise in cybersecurity; and holds a Certified Information Systems Security Professional ("CISSP") certification. Other members of the Company's information security team also hold certifications such as CISSP, Certified Information Security Manager ("CISM"), Certified Ethical Hacker ("CEH"), and Certified Information Systems Auditor ("CISA").

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: 3.Incident response: We monitor the threat landscape 24/7 in coordination with a third-party firm, routinely test our incident response capabilities and preparedness and maintain proactive relationships with law enforcement.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our day-to-day cybersecurity and technology risk management efforts, including oversight of our information security management system, are led by our EVP of Internal Operations, a member of our executive leadership team with over three decades of experience in the field, whose cybersecurity experience includes serving as our Chief Information Officer and in executive roles at other companies leading security, operations, audit, and compliance teams. Our Chief Information Security Officer (CISO), who has over two decades of experience in cybersecurity, reports to the EVP of Internal Operations and oversees our security team. Our CISO's cybersecurity experience includes serving as an enterprise architect and network security architect at a Fortune 25 public retail company.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Management updates the Audit Committee and executives as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: AIRGAIN INC

ticker: AIRG


text: We have a number of policies and procedures supporting the cybersecurity program, including a comprehensive enterprise cybersecurity incident response plan which is activated in the event of a cybersecurity incident. The incident response plan is a detailed playbook that specifies how Gogo classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, the Board, the Audit Committee, the Chief Executive Officer and other senior executives are part of the notification chain.

companyName: Gogo Inc.

ticker: GOGO


text: Management of Cybersecurity Risk We maintain a Cybersecurity Event Plan ("Cybersecurity Plan") which outlines how we identify and manage our cybersecurity risk. The Cybersecurity Plan contains the following elements: • Incident Identification and Reporting – outlines the steps used to promptly identify cybersecurity risks and report those through appropriate means; • Incident Assessment – after collecting information about a potential risk or threat, a protocol has been developed and outlined that will allow a cross-functional team to assess the threat; • Incident Containment – provides for action to be taken to isolate and attempt to contain and minimize any potential threat; • Resolution and Recovery – outlines the steps to be taken, based upon the incident and the systems potentially impacted, to mitigate the potential impact of the threat and restore system access and functionality in the minimum amount of time; • Training and Awareness – development of training and awareness programs to allow employees to understand how to promptly respond in the event of a perceived threat.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: Our cybersecurity team is led by our Senior Director of Cybersecurity, who has over 15 years of experience with IT and cybersecurity. The cybersecurity team reports to our Senior Vice President-Information Technology. The Senior Director of Cybersecurity and the Senior Vice President-Information Technology are part of, and work with, a management Cybersecurity Steering Committee ("CSC"), which meets regularly. The CSC works to ensure strategic alignment of the CSP with our business objectives and priorities. The CSC is chaired by the Senior Director of Cybersecurity and is composed of our Chief Financial Officer, Chief Operating Officer, General Counsel and senior members of our finance, legal, IT, risk management and internal audit teams. The Company has designated an incident response team and defined criteria to guide responses to cybersecurity incidents.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: As a natural gas LDC, Southwest Gas' objective is to comply with the TSA security directives for our gas monitoring and control systems. Pursuant to these directives, Southwest Gas engages outside consultants to regularly review our technical architecture and alignment with the TSA security directives. In addition to complying with these regulations, Southwest Gas takes a quantitative approach to cybersecurity risk to identify areas for future cybersecurity investment and periodically engages experts to attempt to infiltrate our information systems to further strengthen our security posture. We invest in a range of cybersecurity technologies within the perimeter, network, and endpoints, creating a defense-in-depth architecture designed for prevention and response to cybersecurity events and to help minimize risk exposure.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Our cybersecurity program is led by two Chief Information Security Officers (the "CISOs"), both of whom are Certified Information Systems Security Managers with over 15 years of related experience. Their areas of influence are split into two scopes, Business Information Security (CISO - BIS) and Compliance Information Security (CISO - CIS). The mission of the CISO - BIS is second line defense, to define and execute business operations security, cybersecurity operations activities and to identify and mitigate risks. The mission of the CISO - CIS is third line defense, with a focus on governance, risk, and compliance, audits, third-party risk management, and validation of regulatory compliance for the security program. Our cybersecurity program includes the implementation of controls aligned with cybersecurity best practices to identify threats, detect attacks, and protect our information assets. Our cybersecurity program aligns with applicable statutes and regulations to stay abreast of current compliance requirements. We use preventative and detective tools and utilities that provide alerts of vulnerabilities and threats, and alert to patch management requirements. Security monitoring capabilities are designed to alert us to suspicious activity providing the opportunity for quick risk mitigation and remediation. Our incident response program is tested periodically and is designed to provide a clear guide, procedures and communications matrix to adhere to in the event of an incident. The plan facilitates risk mitigation and leads to business recovery and restoration as quickly and as orderly as possible in the event of a critical security incident. In addition, our employees participate in an ongoing program of monthly security awareness training and receive frequent communications regarding the cybersecurity environment to increase awareness throughout the company. We have also implemented an annual training program for specific specialized employee populations, including secure coding training. Notwithstanding the extensive approach we take to cybersecurity, because cyber threats are always evolving, there remains the possibility of a cybersecurity incident which could have a material adverse effect on the organization.

companyName: JBT MAREL Corp

ticker: JBTM