text: The Company has established an Enterprise Risk Committee, which is co-chaired by the Company's Chief Financial Officer and Senior Managing Director of Legal Affairs, and under that framework has chartered a Cybersecurity Sub-Committee, chaired by the Chief Technology Officer. Both committees include various other members of key senior management. Our Board of Directors (including our Audit Committee through delegation as described below), along with our Enterprise Risk Committee and Cybersecurity Sub-Committee, are actively involved in providing oversight of our cybersecurity program. The role of the Board of Directors in the Company's risk oversight process includes receiving reports and presentations from the Enterprise Risk Committee or other senior management leaders on areas of material risk to the Company, including operational, financial, legal and regulatory, strategic, reputational, cybersecurity and Environmental, Social and Governance ("ESG") related risks and any measures taken to mitigate such risks. In addition, the Board of Directors regularly reviews and discusses areas of material risk at its meetings. In essence, the Board of Directors oversees a company-wide approach to risk management, carried out by Company management. With respect to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to the Company's cybersecurity and data-protection measures, including related to monitoring, controlling and mitigating against such risks, and the entire Board receives periodic updates on the Company's cybersecurity risk management processes. There have been no material cybersecurity incidents in the periods presented in this Report.

companyName: JOHNSON OUTDOORS INC

ticker: JOUT


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

companyName: DraftKings Inc.

ticker: DKNG

secItem: Item 1C


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: The Board, in coordination with the Audit Committee, oversees our overall enterprise risk management ("ERM") process, including the management of risks arising from cybersecurity threats and information security. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. Beginning in 2024, the Audit Committee was provided updates on our process, procedures, policies and any cybersecurity incidents at least quarterly. In the event of a material incident, or incident that may be determined to be material, the Audit Committee is informed as soon as reasonably practical and provided regular updates by the SIMT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee have the opportunity to discuss our approach to cybersecurity risk management with the SIMT.

companyName: PubMatic, Inc.

ticker: PUBM


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, including our Cyber and Privacy Risk Committee described above, led by our CISO. Our CISO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and CPG industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CISO has a Master of Business Administration in management and operations and a Bachelor's Degree in technology management, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CISO reports to our CDIO, who meets regularly with other members of our executive team and provides relevant updates on our cybersecurity program.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: We have also established a Security and Privacy Committee ("Committee"), co-chaired by our Senior Vice President, Head of Engineering and General Counsel, that meets monthly. This Committee is responsible for setting cybersecurity policies, strategies, and priorities, as well as ensuring that cybersecurity initiatives are aligned with the Company's objectives. Members of the Committee may, from time to time, include representatives from security and compliance, internal audit, legal, product, engineering, finance, operations, strategy and people and culture functions. In addition to the monthly communications at the Committee level, our Information Security team collaborates with senior leadership across our organization on a regular basis as part of the Company's overall enterprise risk management program.

companyName: Compass, Inc.

ticker: COMP


text: In order to maintain a strong cybersecurity program, Markel uses a variety of controls and technology tools designed to identify, detect, prevent, respond to, and recover from security threats. Markel undergoes regular security audits including a System and Organization Controls (SOC) audit for Cybersecurity conducted annually by independent auditors in which cybersecurity threats are identified and assessed. Markel regularly tests aspects of its internal security and conducts security risk interviews and assessments on third parties with whom it does business, depending on the nature of the relationship. Markel has invested in technology that assists its risk management teams in measuring and addressing weaknesses in its third-party and supply chain community. Markel performs continuous monitoring of all its third parties to ensure they are maintaining acceptable levels of security controls and remediating any known weaknesses.

companyName: MARKEL GROUP INC.

ticker: MKL


text: The Board receives periodical reports from Yubo Beijing's management on cybersecurity risks. In addition, Yubo Beijing's management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: Cybersecurity Risk Management and Strategic Approach The company's information security program is meticulously crafted, integrating administrative, technical, and physical safeguards. Embracing a risk-based approach, we proactively mitigate cybersecurity risks to ensure the confidentiality, integrity, and availability of our information systems and data assets. This comprehensive framework extends to overseeing service-provider relationships, aligning with the specific risks associated with each engagement.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Our CISO is a member of our management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. We believe our CISO and the information security organization have the appropriate expertise, background and depth of experience relating to monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents to manage risks arising from cybersecurity threats. The CISO works in coordination with other members of the management team, including, among others, the Chief Digital Officer, the Chief Financial Officer and the Chief Legal Officer and their designees.

companyName: PFIZER INC

ticker: PFE


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a breach, we have a comprehensive plan in place for assessing and addressing any potential threats to our information security. We maintain a Cyber and Data Incident Response Plan and Framework, which identifies and describes the roles and responsibilities of the Cyber Incident and Response Team and the Crisis Oversight Committee. The Cyber Incident Response Team is responsible for receiving information relating to possible incidents, investigating and analyzing them, and taking the appropriate action to avoid and mitigate the damage caused by such incidents. The Crisis Oversight Committee, chaired by our CBO, is responsible for support and oversight of the Cyber and Data Incident Response Plan and Framework and oversight of the Cyber Incident Response Team's execution of the plan in the event of a cyber incident.

companyName: Enstar Group LTD


text: To evaluate the adequacy of our cybersecurity program, we apply various assessment techniques, such as continuous asset audit, vulnerability management, external attack surface management, source code review, a bug bounty program, threat hunting, red-team exercises, and direct engagement with functional leaders. We routinely examine our cybersecurity defenses through automated and manual vulnerability scanning to identify and correct critical vulnerabilities. In addition, we conduct regular testing to evaluate our security posture and the adequacy of our policy as a whole. We compare our cybersecurity program against industry standards and established frameworks, such as the NIST and Center for Internet Security. Further, we engage in cyber incident simulation exercises executed by senior management and IT/Information Security personnel, involving hypothetical cybersecurity incidents to test our cyber incident response processes. In addition to the foregoing internal review of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other things, these independent parties analyze the effectiveness of controls over information technology resources and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes for qualifications under recognized industry standards and for annual certification under Payment Card Industry Data Security Standard (PCI DSS), HITRUST, SOC 2 Type II, and ISO 27001. We memorialize our findings and review the results of these assessments with management and, where appropriate, our board of directors. Relevant modifications are incorporated into our cybersecurity framework to ensure that our systems functionally align with our cybersecurity strategies. Additionally, as the threat environment evolves, we have continued to refine our cybersecurity program in response to prior cyber incidents that have specifically impacted us, and that have more expansively impacted other companies; for example, we have recently instituted an incentive program for reporting of fraud threats and modified our employee training programs.

companyName: TaskUs, Inc.

ticker: TASK


text: Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee of our Board, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks. Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assesses the effectiveness of information technology and data security processes. The materials presented to our Board and CGN Committee include updates on our data security posture, results of third-party assessments, progress towards pre-determined risk-mitigation related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Board and the CGN Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.

companyName: SYNOPSYS INC

ticker: SNPS


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;

companyName: TREVENA INC


text: Our management team, including our Head of Information Technology, is responsible for addressing, assessing, and managing our material risks from cybersecurity threats. Our head of Information Technology supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants (when applicable). Our management team's experience includes demonstrated expertise in cybersecurity, mobile and data devices, and smartphone software. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: DNA X, Inc.

ticker: SONM


text: Our risk management program is designed to identify, assess, manage, and mitigate risks across various aspects of our Company, including, but not limited to, financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Our cybersecurity processes are grounded in the National Institute of Standards and Technology Cybersecurity Framework and include a number of different preventative measures. The Company performs periodic risk assessments of systems and applications to identify risks, vulnerabilities and threats in systems and software, performs an annual assessment of the effectiveness of the current cybersecurity response process by conducting incident response tabletop exercises that involve participation by members of the management team, and requires all teammates to participate in user awareness training for information technology and cybersecurity.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: Board Oversight and Governance WTW's board of directors has delegated the oversight of cybersecurity risks to the Risk and Operational Oversight Committee (the 'Risk Committee'), which was recently formed following the completion of the three-year term of the Operational Transformation Committee. The Risk Committee assists the board of directors in its oversight of the ERM framework, policies, and practices used by WTW to identify, assess, and manage WTW's key operational risks, including without limitation: cybersecurity, technology, information security, privacy, and artificial intelligence risk. WTW's Chief Information Security Officer ('CISO') and Global Head of Technology report to the Risk Committee on cybersecurity matters, including key risks. The Risk Committee reports to the board of directors at each formal board meeting and the board of directors discusses those reports.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: The Adviser has implemented policies and associated controls and procedures to safeguard both firm and client data and assets (the "Cybersecurity Program"), and the Cybersecurity Program continues to evolve in an effort to keep pace with industry best practices and ever-changing cyber threat environment. The Cybersecurity Program is designed to protect the confidentiality, integrity, and availability of client and consumer information systems, and the Adviser's proprietary information in compliance with SEC Guidance 2015-02 regarding Cybersecurity, and FINRA's guidance regarding Customer Information Protection, and interagency guidance on safeguarding information. Periodic updates on the Cybersecurity Program are provided to the Adviser's Head of Risk, along with the Adviser's Risk Committee, and the Board.

companyName: First Eagle Private Credit Fund


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance, which is overseen by Caterpillar and forms a part of Caterpillar's cybersecurity strategy, risk management and governance. A description of Caterpillar's cybersecurity strategy, risk management and governance can be found under Item 1C. Cybersecurity in Caterpillar's 2023 Annual Report on Form 10-K filed separately with the Securities and Exchange Commission.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: Our team leverages over 25 years of experience in various cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.

companyName: EyePoint, Inc.

ticker: EYPT


text: We rely on information technology and data to operate our business effectively and recognize the importance of implementing and maintaining cybersecurity systems and processes that allow us to protect the confidentiality, integrity and availability of our information systems and the data residing within them.

companyName: INFINITY NATURAL RESOURCES, INC.

ticker: INR


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. This cybersecurity risk management process includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access and other security incidents and vulnerabilities.

companyName: Digital Turbine, Inc.

ticker: APPS


text: We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive data. We prioritize a robust due diligence program for key third-party service providers, utilizing a comprehensive due diligence questionnaire to evaluate potential risks before establishing formal partnerships. This in-depth approach applies to all vendors with access to our sensitive systems or data. Ongoing assessments are customized based on each provider's risk profile, with heightened scrutiny applied to new engagements and high-risk relationships. Existing vendors are subject to periodic reevaluations according to a predetermined schedule, with increased frequency for those deemed higher risk.

companyName: Perella Weinberg Partners

ticker: PWP


text: We use the CIS benchmarks as a guideline to strengthen our cybersecurity practices. This is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our adoption of the CIS benchmarks is a helpful baseline for potential future alignment with internationally recognized frameworks such as NIST Cybersecurity Framework, or ISO 27001.

companyName: AIRGAIN INC

ticker: AIRG


text: Role of Management At the management level, our Chief Information Security Officer ("CISO") leads cybersecurity initiatives and reports regularly to the President on security posture, risk trends, and key incidents. Our President is a seasoned technology and business leader with over 20 years of experience in managed IT services and global scale multi-site private cloud datacenter operations. His background and experience provide him with expertise regarding data privacy and security, vulnerability management, security operations, and application security. In addition, our Chief Operating Officer has many years of experience with managed IT cyber application delivery.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Protect against anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to, use of, or transfer of such information in a manner that could harm or inconvenience the Company, employees or customers.

companyName: STURM RUGER & CO INC

ticker: RGR


text: The three lines of defense model is designed to provide a structure for risk accountability in the first line of defense ("FLOD"), effective challenge by the second line of defense ("SLOD"), and independent risk assurance by the third line of defense ("TLOD"). Our Office of the Chief Information Security Officer serves as FLOD and provides operational and technical controls and capabilities to protect against cybersecurity risks. The Technology and Information Security team serves as SLOD and provides independent oversight of our technology and cybersecurity risk mitigation practices and capabilities. As TLOD, Internal Audit independently assesses the effectiveness of our first and second line of defense organizations in managing cybersecurity risk and independently reports the results of audits to our ARC Committee to assist it in its oversight duties.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: Blue Owl Capital Corp II


text: The Director, Global Information Technology and Financial Systems (the "IT Director"), leads an internal team who work directly with our third-party vendors to manage our cybersecurity risk management program and activities. The internal team monitors our information systems for cybersecurity threats, reviews cybersecurity incidents, analyzes emerging threats, and develops and implements risk mitigation strategies. Under our CFO's authority, the IT Director periodically reports on the cybersecurity program to our executive leadership team, including by providing the team with updates on cybersecurity threats and incidents, the status of ongoing projects and initiatives, performance metrics, and additional cybersecurity topics. On an annual basis, the IT Director reviews the results of the current state of cybersecurity risk management, including the results of our cybersecurity risk assessment and any action plan to address any identified vulnerabilities.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We recognize the importance of protecting consumer and employee data and maintaining the safety and security of our information systems. We identify, assess and manage material risks on an enterprise basis through our global enterprise risk management ("ERM") program. We maintain a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats, which is aligned to and informed by our ERM program. Our cybersecurity program takes into consideration, among other things, compliance requirements, risks to our revenue channels, risks posed by third-party engagements, consumer and employee data security and global enterprise security. We engage independent third parties to conduct regular penetration testing and targeted security audits of our information systems. In addition, we engage a third-party vendor to conduct 24/7 monitoring of cybersecurity alerts. In the event we identify or are notified of a potential cybersecurity, privacy or other data security incident, we have a data incident response plan that defines procedures for responding to such incidents, including when and how to engage with our executive leadership team, our Board of Directors, other stakeholders and law enforcement, as applicable. We also maintain cyber liability insurance to help defray financial losses arising out of a cyber security incident; our insurance, however, may not cover all types of cybersecurity incidents or all losses that we incur.

companyName: Under Armour, Inc.

ticker: UAA


text: Our cybersecurity program is designed to assess, identify, and manage cybersecurity risks and threats. Key components of our cybersecurity program include: • managing cybersecurity threats by deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, which we evaluate and seek to improve, including through vulnerability assessments and cybersecurity threat intelligence; • maintaining cybersecurity incident management procedures to address incident reporting, classification, escalation, response, and recovery, and facilitate efficient and consistent management of cybersecurity incidents involving our information systems; • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures and manage our bug bounty program; • a cybersecurity risk management process for third-party vendors, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors; and • cybersecurity awareness training is available for all employees and enhanced training is provided for certain employees.

companyName: ROKU, INC

ticker: ROKU


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Omega Therapeutics, Inc.


text: The Company has also implemented an Incident Response Plan which is reviewed and updated at least annually in response to an ever-changing threat landscape. The purpose of the Incident Response Plan is to provide long-term strategies for the remediation and prevention of, and resiliency to, cybersecurity threats and incidents. Our Incident Response Plan is executed through the incident response team comprised of both cybersecurity experts and select members of management, including one or more Information Security Officers, who are responsible for monitoring potential threats and identifying events that may warrant Board notification and/or public disclosure. Additionally, our Information Security Officers are responsible for responding to security events by ordering emergency actions to protect the Company and its customers; managing negative effects on the confidentiality, integrity, and availability of information; and minimizing the disruption and degradation of critical services.

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our board of directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, including the Company's risk profile and exposures as they relate to cybersecurity, conducting reviews of policies regarding risk assessment and risk management and major risk exposures, as well as evaluations of risks from potential or actual cybersecurity threats. Our Chief Information Officer, Vice President of Infrastructure, and Security Administrator have responsibility of cybersecurity oversight of the Company and each have 12, 15, and 6 years of cybersecurity experience, respectively. The Security Administrator reports to the Vice President of Infrastructure, who in turn reports to the Chief Information Officer. Members of the Board receive regular quarterly cybersecurity updates from our Chief Information Officer, including updates on existing and new cybersecurity risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Douglas Emmett Inc

ticker: DEI


text: The CSO and Akamai's information security team regularly communicate the nature and state of security risks to senior business leaders across the organization. In addition, the CSO meets on a regular basis with the Information Security Committee to provide cybersecurity program updates and to discuss potential risks and changes in the cyber threat landscape in which we operate. On a quarterly basis and as needed, the CSO reports to the Audit Committee to provide information on, as applicable and appropriate, cybersecurity risk management programs, risk mitigation, cybersecurity incidents and related disclosure obligations, if any, information on new or changing threats and other cybersecurity matters. The Audit Committee Chair reports to our board at least quarterly on our cybersecurity risk management program, including risk mitigation, cybersecurity incidents and other relevant developments in our cyber threat landscape. In addition to formal reporting, the CSO takes part in informal meetings as needed and requested with Akamai's management, including the Chief Executive Officer and the board of directors.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: We do not have any processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: GOLDENWELL BIOTECH, INC.

ticker: GWLL


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors – We rely heavily on our information technology systems, as well as those of our vendors, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption or security breach could adversely affect our business, financial condition and operations," the sophistication of cyber threats continues to increase, and the actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. As such, no matter how well our controls are designed or implemented, we cannot assure that we will be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: We have not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors has oversight responsibility for our overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. We recently obtained SOC-II Type 1 compliance on March 18, 2025. During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Wellgistics Health, Inc.

ticker: WGRX


text: Management reports to the Board, as appropriate, on cybersecurity matters, including significant incidents (if any) and actions taken to enhance the Company's cybersecurity program.

companyName: Hartford Creative Group, Inc.

ticker: HFUS


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our security architecture and controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or intentional employee actions, system failures, and other risks that could materially impact our financial results and our results of operations.

companyName: Ingevity Corp

ticker: NGVT


text: Board of Directors -- The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee and the full Board of Directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or Chief Technology Officer.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel and cybersecurity consultants.

companyName: Regulus Therapeutics Inc.


text: This information security program is a key part of the Company's overall risk management system. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of the Company's businesses and geographic locations.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: Our cybersecurity program is regularly assessed through activities such as penetration tests, internal audit assessments, an annual external PCI compliance audit in the CPI business, and ISO 27001 re-certification in the Currency business. The results of these assessments are reported to our Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices to reduce cybersecurity risk based on the information provided by these exercises and assessments. Our cybersecurity team also conducts an annual incident response exercise that includes executive leaders to ensure alignment should we experience a cybersecurity incident.

companyName: Crane NXT, Co.

ticker: CXT


text: Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered committees to provide more focused oversight. In the case of cybersecurity and technology risk, in 2024 the Board formed the Technology Steering Committee which has that responsibility.

companyName: NewtekOne, Inc.

ticker: NEWT


text: None of the cybersecurity risks, including as a result of any prior incidents we have experienced, have had a material adverse impact on our operations, business or financial condition.

companyName: GRACO INC

ticker: GGG


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating and Corporate Governance Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: TILLY'S, INC.

ticker: TLYS


text: Oversight responsibility for information security matters is shared by the Board, Chief Financial Officer ("CFO"), VP of Internal Audit and our internal information technology ("IT") resources. Our CFO and VP of Internal Audit oversee our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives quarterly updates from IT and the third-party IT service provider on cybersecurity and information security matters. The CFO communicates with the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Board for timely and accurate reporting of any material cybersecurity incident.

companyName: Kartoon Studios, Inc.

ticker: TOON


text: Lam Research Corporation 2025 10-K 25 For additional information on certain risks associated with cybersecurity, please refer to "Our Business Relies on Technology, Data, Intellectual Property and Other Sensitive information That is Susceptible to Cybersecurity and Other Threats or Incidents" in Item 1A: Risk Factors.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: We recognize that cybersecurity risks pose a significant threat to our business, clients, and stakeholders, and we have implemented a comprehensive cybersecurity program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our stakeholders' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, and OWASP Top 10, we prioritize the identification and assessment of risks to create a protective shield around our clients' data. This guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, auditing our vendors and audits from clients.

companyName: Simulations Plus, Inc.

ticker: SLP


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, the Company also maintains cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. For further discussion of risks from cybersecurity threats, see the section captioned "Operational Risks" in Item 1A. Risk Factors.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: Depending on the environment and system, we have implemented a number of measures and policies designed to enhance the security and resiliency of our network, information and data systems, including but not limited to: encryption standards; antivirus protection; remote access; multifactor authentication; treatment of confidential information and the use of the internet, artificial intelligence, social media, email and wireless devices; user access control management; intrusion monitoring systems; information security continuity measures, including redundant systems and information backups; network segmentation; encryption of certain data; event logging; and implementation of an application patching and update cadence. These measures and policies go through an internal review process and are approved by appropriate members of management.

companyName: PATTERSON COMPANIES, INC.


text: We will seek to integrate these measures into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. We may work with outside consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, we expect that our policy strategy will include a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: NETWORK CN INC

ticker: NWCN


text: Our Chief Information Officer and Director of Information Security, along with members of their respective teams, are responsible for identifying and managing cybersecurity risk. The Senior Leadership Team, the Board of Directors and the Board's Audit Committee receive regular updates and engage in regular strategic discussions relating to cybersecurity risk management as part of their overall oversight of risk management.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including a security operations center (SOC) provider, specialists in backup and recovery, a forensic investigation firm, a ransomware recovery vendor, insurance providers and various law firms.

companyName: Playa Hotels & Resorts N.V.


text: These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Technology Officer ("CTO"), and include mechanisms, controls, technologies, systems and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits and ongoing risk assessments, including due diligence on and audits of our key technology vendors and other contractors and suppliers. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends and their impact on the Company's risk environment. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information.

companyName: DocGo Inc.

ticker: DCGO


text: All incidents are reported to the Security Steering Committee, and events that may result in a material loss are additionally reported to the Audit Committee and evaluated for public disclosure as well as disclosure to the appropriate authorities. The Audit Committee oversees management's remediation actions relating to such events, and approves management's assessment of the materiality of the event to the Company.

companyName: MediaAlpha, Inc.

ticker: MAX


text: The principal objectives of our cybersecurity program ("Cybersecurity Program") are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect confidential information, our intellectual property and other assets, and those of our investors, tenants, vendors, partners and employees that may be at risk due to our cybersecurity threats.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: The Company assesses cybersecurity risks and changes in the cyber environment and adjusts its practices as deemed appropriate. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K for additional information on risks related to the Company's business, including cybersecurity risks.

companyName: Quanex Building Products CORP

ticker: NX


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief Operating Officer, Chief Financial Officer and General Counsel. This team of business leaders works with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified.

companyName: AMBARELLA INC

ticker: AMBA


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section titled " Risk Factors—If our electronic data is compromised, or we experience a failure in our information technology or storage systems, our business could be significantly harmed " included within this Annual Report.

companyName: Expion360 Inc.

ticker: XPON


text: Our Privacy and Information Security Committee, comprised of officers and senior leaders, is responsible for overseeing the development and maintenance of information privacy and security policies and effective operation of our corporate information security and cybersecurity program in compliance with applicable state insurance regulations and other legal and regulatory requirements. This committee is sponsored by and reports directly to our Executive Council, which includes our Chief Executive Officer and executive vice presidents.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: The prevention, detection, mitigation and remediation of cybersecurity incidents is accomplished pursuant to various policies, procedures and processes, including our incident response and recovery plan and the other elements of our enterprise security program described above under "Risk Management and Strategy." These measures include escalation protocols through which the Cybersecurity Steering Committee is informed about cybersecurity and incidents by our CISO. As part of our enterprise security program, we have communication processes enabled for employees to identify and report threats or potential vulnerabilities.

companyName: ANALOG DEVICES INC

ticker: ADI


text: The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information security, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This framework organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company regularly assesses the threat landscape of cybersecurity risks, with a layered defense in depth strategy that is focused on prevention and detection.

companyName: NBT BANCORP INC

ticker: NBTB


text: Third-party assessment findings are logged in our internal audit system and tracked until mitigated and/or remediated. These assessments are documented and reviewed with the Company's Chief Executive Officer and Chairman, Chief Operating Officer, Chief Information Officer, General Counsel, as well as the Government Security Committee ("GSC") of the Board. Both the Internal Audit team and the Chief Information Security Officer are responsible for reporting any material assessment findings to their respective Board committees.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Our Board of Directors articulates the Company's attitude towards risk. Associated risk metrics are monitored quarterly by Management and reported to the Audit Committee of the Board and the Board of Directors. Management measures and reports inherent risk, mitigating controls, residual risk and emerging risk for various key risk categories, inclusive of cybersecurity and information security risks, on at least a quarterly basis.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: The Audit Committees are responsible for oversight of our risk management with respect to information technology operations and cybersecurity while the Compliance Committees oversee risk management in the area of data privacy and the HESS Committees oversee risk management related to our maritime operational technologies. The Audit Committees receive updates from the CISO on our information technology operations, including cybersecurity developments and risks, three times a year, and our Board of Directors receive updates from the CISO on an annual basis.

companyName: CARNIVAL PLC

ticker: CUK


text: The third line of defense is the internal audit function, which provides independent assurance of the effectiveness and adequacy of the IS program, as well as compliance with relevant policies, standards and regulations.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a cybersecurity insurance policy in place to help mitigate monetary losses of a potential cybersecurity attack.

companyName: SURGE COMPONENTS INC

ticker: SPRS


text: Our IT security team reviews enterprise risk management-level cybersecurity risks annually. The following key risk elements are evaluated: • Insiders – Whether intentional or unintentional, individuals within our Company may cause damage to our systems. We have processes in place to seek to mitigate these threats, including but not limited to controls over access to our systems and access to network resources. • External threats – We recognize the risk that hackers, vandals, and saboteurs may seek to gain access to information contained in our systems. We employ multi-layered defense and continuous monitoring to seek to mitigate the risk associated with these threats. The Company also conducts regular periodic training of its employees as to the protection of sensitive information which includes security awareness training intended to prevent the success of "phishing" attacks. • Third-party risks – We also consider and evaluate cybersecurity risks associated with use of third-party service providers. User access to third-party systems is reviewed annually, and we obtain and review a System and Organization Controls (SOC) 1 or SOC 2 report from key third-party service providers. Key cybersecurity risks and mitigating responses are addressed within our Company-wide policies.

companyName: ASTRONICS CORP

ticker: ATRO


text: Following these risk assessments, we intend to take any steps necessary to redesign, implement, and maintain reasonable safeguards to minimize identified risks; to reasonably address any identified gaps in existing safeguards; and to regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant, who reports to our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and periodically evaluate our safeguards.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: We work with consultants or other third parties as part of our risk assessment processes, when appropriate. They help us create and execute our cybersecurity policies and procedures and check and test our safeguards. We ask key third-party service providers to confirm that it can apply and keep appropriate cybersecurity measures in line with all relevant laws, to apply and keep reasonable cybersecurity measures when they work with us, and to promptly report any possible breach of their cybersecurity measures that could impact our company.

companyName: 89bio, Inc.


text: GlobalX's Audit Committee, comprising board members and senior management from various departments including IT, operations, legal, risk management, and others, diligently engage in regular cybersecurity risk assessments. These comprehensive assessments are designed to proactively identify potential threats, vulnerabilities, and risks that could impact the integrity and security of the company's airline systems, data infrastructure, and operational continuity. Evaluations span critical areas such as safeguarding flight systems, protecting passenger data, and mitigating operational disruptions.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Our Information Security Efforts Cybersecurity Risk, Management, and Strategy The performance, reliability, and security of the networks and technology infrastructure we use or rely on is critical to our operations, our institutions' reputation, and our ability to attract and retain students. We have developed what we believe to be a robust cybersecurity program that incorporates a process of identifying and managing cybersecurity risks across the enterprise. As part of our cybersecurity risk management process, we identify risk by reviewing the elements within our technology stack and processes, including a full scan and identification process designed to cover all APEI's digital and physical assets within the organization, covering hardware, software, data, and personnel. Assets are documented and assessed for their value, factoring in their significance and potential cost if compromised. We conduct a threat assessment for both internal (e.g., employees, contractors, etc.) and external (e.g., hackers, malware, etc.) cybersecurity threats, and we have established plans and actions to detect unauthorized activities. We engage third-party consultants to perform assessments, including annual penetration testing, and we maintain a risk register. The risk register includes documentation of identified risks, the potential impact and likelihood of occurrence, mitigation efforts and the required enterprise level response. Each of the identified risks is given a risk classification from low to high depending on the probability of occurrence and the severity of impact.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Our management team including the Executive Vice President, Technical Operations and Administration is responsible for assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes collective decades of experience working in and overseeing information technology and cybersecurity functions, technical cybersecurity certifications, and active membership in cybersecurity professional organizations, as well as local groups, to support knowledge sharing and ongoing education.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Incident Response Procedure We have a 24/7 managed Security Operations Center (SOC) for escalation of any critical events, including cybersecurity incidents. In the event of an incident, we use an Incident Response procedure leveraging NIST Standard 800-61 standards that we have customized for Zoetis. Additionally, we have in place disaster recovery and business continuity practices designed to provide for continuous business operations for our customers in the event of a cybersecurity incident. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Zoetis Inc.

ticker: ZTS


text: The Board recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee, and vendor information, as well as non-public information about UNIFI. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of the Board has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.

companyName: UNIFI INC

ticker: UFI


text: Our IT infrastructure is maintained with up-to-date software, including the latest security patches. This policy helps protect against vulnerabilities that could be exploited by cybercriminals.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Our management team, including our Chief Information Security Officer ( CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 20 years of experience managing the security and compliance organization for global companies, providing online and cloud-based services to more than a majority of the Fortune 500 and the United States Government.

companyName: Stride, Inc.

ticker: LRN


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; and cybersecurity software and managed cybersecurity service providers.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Management's Role Managing Risk The role of the Chief Information Security Officer (CISO) has been assigned to our VP, Information Technology, who has 20 years of IT experience and reports to the CFO. The CISO and the CFO inform the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on no less than an annual basis or on an ad hoc basis when needed. These briefings encompass: Evaluation of existing cybersecurity risks; Status of ongoing cybersecurity initiatives and strategies from the cybersecurity roadmap; and Incident reports and learnings from cybersecurity events.

companyName: electroCore, Inc.

ticker: ECOR


text: We have made significant investments in modernizing, streamlining, and simplifying our technology footprint to both enhance customer experience and strengthen our internal security controls.

companyName: International Land Alliance Inc.

ticker: ILAL


text: The CISO briefs the Audit Committee on cybersecurity matters at each quarterly meeting, and annually meets with the Audit Committee in executive session to report on cybersecurity matters. In addition, cybersecurity training on the current cybersecurity landscape and emerging threats is provided to the board of directors.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Our management team, through our Chief Technology Officer and CISO, stays informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, review of threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers, and receiving alerts and reports produced by security tools deployed in our IT environment. Our CISO relies on close collaboration with other internal infrastructure, product, engineering, and legal teams to implement our cybersecurity risk mitigation measures.

companyName: Maplebear Inc.

ticker: CART


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to the Company's global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.

companyName: CNH Industrial N.V.

ticker: CNH


text: We have not adopted any cybersecurity risk management program or formal procedures for assessing cybersecurity risks. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our Board for further actions, including the implementation of mitigation measures or other response or actions that the Board deems appropriate to take.

companyName: Future Vision II Acquisition Corp.

ticker: FVN


text: Technical Controls We have implemented a technical security architecture consisting of a multitude of controls to identify, protect, detect, and respond to cybersecurity events. Continually evaluating common and best practices for deploying these controls, as well as determining when new or alternative controls may be more appropriate or effective, aids in our ability to counter actions from evolving threat actors. We also leverage various sources of cyber intelligence to ensure that technical controls maintain optimal configuration and deployment models to increase control effectiveness.

companyName: Loar Holdings Inc.

ticker: LOAR


text: Our management team, including our CISO, is responsible for assessing and managing any potential material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 40 years of combined cybersecurity experience across architecture, engineering, operations and compliance.

companyName: Eventbrite, Inc.

ticker: EB


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors - Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products' development programs, jeopardize sensitive information, prevent us from accessing critical information or result in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business." in Part I, Item 1A herein.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: The CISO reports to ERC on a quarterly basis regarding the cybersecurity program and material cybersecurity risks. The quarterly report includes the following information: information security incidents, internal phishing risk, defensive coverage and response of our endpoints, and internal and external vulnerability scan results. The ERC is also apprised of training, regulation or guidance changes, and new products and services utilized by the Information Security Department. In addition to a cybersecurity risk assessment that is performed by the CISO, management is responsible for conducting a risk assessment to identify data security, information technology, and cybersecurity risk factors impacting their business line. The results are reviewed by the Risk Division and presented to ERC.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Governance – Conveying Risks to the Board of Directors The Chief Information Officer ("CIO") and Chief Financial Officer ("CFO") play a pivotal role in keeping the Audit Committee apprised of cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis at the Audit Committee meetings. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks to ensure that the Board Director's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance for major initiatives. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee or Board of Directors, as appropriate, through the Board-approved escalation protocol.

companyName: Cornerstone Building Brands, Inc.


text: We use, among other frameworks, the NIST Cybersecurity Framework and CIS Critical Security Controls as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.

companyName: SolarWinds Corp


text: The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CFO, who reports directly to the Chief Executive Officer. Our CFO leads a team of dedicated professionals who are responsible for a wide range of risk assessment and management and leads specialized teams of internal and external experts focusing on distinct categories of threats.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: As part of the above-planned processes, we may engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: LIBERTY STAR URANIUM & METALS CORP.

ticker: LBSR


text: We have a Cybersecurity Incident Response Plan ("CSIRP") to provide the organizational and operational structure, processes, and procedures for investigating, containing, documenting and mitigating cybersecurity incidents. We have implemented a risk-based approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: MANITOWOC CO INC

ticker: MTW


text: Our Chief Financial Officer, Chief Operating Officer and Director of IT have substantial relevant expertise in the life sciences industry and formal training in the areas of information security and cybersecurity risk management, and are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Axonics, Inc.


text: Our VP of Information Technology and support team also have a reporting responsibility to the executive leadership and the Board. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the Board and other stakeholders on an as needed basis. The Board receives regular reports from management on our cybersecurity program, risks and activity. Our VP of Information Technology has more than 25 years of experience in IT infrastructure, cybersecurity operations, and software engineering.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Our Senior Vice President of Information Technology has served in his role since January 2020 and has managed STORE's Information Technology department since joining the Company in January of 2015. In these roles, he has been instrumental in the evolution and implementation of our business systems and technical infrastructure as well as the development and enforcement of Sarbanes-Oxley (SOX) compliance processes and reporting. Prior to joining STORE, he was the Chief Information Officer for Southwest Network, a non-profit organization for mental and behavioral health services serving the greater Phoenix, Arizona community. He has over 35 years of experience in the information technology industry serving in several technical and leadership positions.

companyName: STORE CAPITAL LLC


text: Our Director of Information Technology is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of our management team. The Director of Information Technology works in coordination with the other members of our cybersecurity committee, which includes our Chief Financial Officer, Chief Accounting Officer and In-house Counsel. Our Director of Information Technology has served in various roles in information technology and information security for over 26 years. Our Director of Information Technology, in coordination with our cybersecurity committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through the ongoing communications with our organization, the Director of Information Technology and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our approach is to treat cybersecurity not just as a technology issue, but to recognize that it can have wide-ranging impacts on the business, operations, and financials of our company.

companyName: Sunrun Inc.

ticker: RUN


text: Our cybersecurity program includes the following key elements: • Identification. Avanos maintains an inventory of IT assets, comprising hardware and software, as well as the associated risk profiles of those systems and applications. We utilize a risk management strategy and annual risk assessment process to identify key risk areas based on the holistic threat landscape facing Avanos and our industry. To define that threat landscape, we utilize threat intelligence feeds, such as those provided by Health Information Sharing and Analysis Center (Health-ISAC) and a third-party vendor, to determine security threats to the Company and other healthcare and life science organizations. • Protection. We utilize multiple intrusion protection systems and processes to protect our technology assets. These protections include Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Vulnerability Management, Endpoint Detection and Response (EDR), Advanced Anti-Phishing and Awareness trainings, Network and Cloud Security and other protective technologies. Annual audits are conducted to assess these controls.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: c.significant policies, programs and plan documents related to the management of cybersecurity risk and proposed changes to any of such documents; d.the Company's controls to prevent, detect and respond to cyberattacks or information or data breaches;

companyName: MANNATECH INC

ticker: MTEX


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We regularly conduct vulnerability scans and penetration testing both internally and using third party vendors. We also engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures on an annual basis. The assessments include information security maturity evaluations, independent environmental security control reviews, and operating effectiveness. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews. We have been assessed and obtained a HITRUST r2 certification of our production environment.

companyName: Augmedix, Inc.


text: Our assessment and management of risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is identified and addressed as a component of our general risk management strategy. We have also established a cybersecurity committee consisting of our Senior VP of Global IT and System Operations, IT Security Officer, information security team, and other senior leaders to oversee our cybersecurity risk management process and strategies to mitigate cybersecurity threats.

companyName: ENZO BIOCHEM INC


text: Our Senior Vice President of Technology's relevant cybersecurity expertise includes Certified Information Systems Security Professional ("CISSP") designation, ISO 27001 as well as over 20 years of experience as a technology and security professional.

companyName: Cottonwood Communities, Inc.


text: The Company has experienced cybersecurity threats, cybersecurity incidents and vulnerabilities in its information systems and those of third-party business partners. As of the date of this filing, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. If, in the future, the Company's or a third party's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation including individual claims or consumer class actions, commercial litigation, administrative, civil or criminal investigations or actions, regulatory intervention, government enforcement actions, penalties, sanctions or fines, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption or alteration of data, payment of ransom, or investigation and remediation costs, which could result in a negative impact on the Company's business strategy, results of operations, financial condition or reputation. See "Risks Related to Cybersecurity" in Part I, Item 1A. Risk Factors, in this Annual Report on Form 10-K.

companyName: HYSTER-YALE, INC.

ticker: HY


text: Our Vice President of Information Technology & Corporate Facilities has served in this role since 2018. In this role, he manages and oversees the Company's network and information systems. Additionally, he works with the executive officers, management representatives and third-party experts to maintain the Company's Cybersecurity Program. Our Vice President of Information Technology & Corporate Facilities possesses extensive experience in technology and cybersecurity gained over his career spanning more than 25 years, including service as the executive director of Business Applications as well as a senior implementer and business consultant.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: Cybersecurity and affiliated risks related to our information technology are a key component of our Board of Director's ("Board") risk oversight. The Audit Committee assists the Board in evaluating our information and cybersecurity risks and overseeing our efforts to mitigate these risks. Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity and financial risks. Our Chief Information Officer provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks.

companyName: Meritage Homes CORP

ticker: MTH


text: The Company is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms at the Board and management levels to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: Matador Resources Co

ticker: MTDR


text: Our Chief Information Officer is responsible for assessing and managing our material risks from cybersecurity threats. He has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: TILLY'S, INC.

ticker: TLYS


text: Our cybersecurity risk management and strategy processes are led by our CTO and our CISO. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security; developing cybersecurity strategy; and implementing effective information and cybersecurity programs, including governance, risk and compliance oversight for regulatory and contractual compliance. Such individuals are required by their job description to possess several relevant degrees and certifications, including the Information Systems Audit and Control Association ("ISACA") Certified Information Security Manager and the International Information System Security Certification Consortium ("ISC2") Certified Information Systems Security Professional certifications. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: TrueBlue, Inc.

ticker: TBI


text: We engage third party services in connection with our processes for vendor security reviews and incidents. We are continuing to refine our processes to oversee and identify the risks from cybersecurity threats associated with our use of any third-party service provider.

companyName: Unity Software Inc.

ticker: U


text: Our Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. Our Board receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least quarterly, the Board discusses the Company's approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").

companyName: BOYD GAMING CORP

ticker: BYD


text: Our management team's experience includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together, this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: QVC Group, Inc.

ticker: QVCGA


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Information Security Officer is responsible for information security and cybersecurity risk management. He has over 40+ years of financial services related experience, including 10+ years of experience in cybersecurity program strategy, security architecture and security team leadership. Our Chief Technology Officer, who has over 25+ years of experience in financial services, including 15+ years in information technology, among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the Information Security Officer.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: The audit committee receives periodic reports from the CTO and/or CISO concerning the company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to the Company's cybersecurity threats, risk and mitigation. The audit committee will keep the full board of directors apprised of the company's cybersecurity risk processes and significant developments related to cybersecurity.

companyName: PagerDuty, Inc.

ticker: PD


text: We engage third-party consultants for assessing, identifying and managing material cybersecurity risks, including those associated with certain third-party providers. We maintain a cyber incident response plan and regularly conduct simulations and tabletop exercises.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our processes for assessing, identifying, and managing cybersecurity risks include tabletop exercises to test and reinforce our incident response controls, control gap analyses, penetration tests, data recovery testing, internal and external security assessments, and threat intelligence monitoring. We also conduct annual cybersecurity and data privacy training, which is mandatory for all our full- and part-time employees. In addition to our in-house cybersecurity capabilities, we also engage assessors, consultants and other third parties to assist with various cybersecurity matters. For example, Verizon validates enterprise cybersecurity maturity every two years through a third-party maturity assessment. This assessment measures Verizon's ability to identify, prevent, detect, respond to, and recover from threats to systems, assets and data. The results of the assessment serve as the baseline for enterprise cybersecurity across the company. In addition to this baseline, certain subsets of our technology environment are subject to incremental cybersecurity certification and periodic third party validation under applicable regulatory or contractual requirements.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Cybersecurity operational measures Operationally, the Company's overall cyber risk strategy is a collaborative process between the CIO and the information technology teams, and the CISO led data protection, information and cyber teams. The CIO oversees the establishment and implementation of the technical plan for cyber risk strategy which the CISO and his team reviews and critiques. After they have established a joint cyber risk plan, the Company's second line of defense reviews and challenges the plan. Thereafter, the CISO and CIO teams cooperate with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. As an ongoing operation, the Company's SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC's oversight through SIEM, and with support of the Company's CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to detect, manage, respond to, resolve and recover from events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: The IT security department is responsible for the day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's IT security department operates under general oversight of the Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO). The Company's CIO has 27 years of technology and technology leadership experience, including 14 years serving as a CISO, in the insurance industry. The head of the Company's IT security department, who reports to the CIO, holds a Certified Information Systems Security Professional designation from the Information Security Certification Consortium, has 20 years of experience in the insurance industry and has served in IT security-related roles for 24 years.

companyName: RLI CORP

ticker: RLI


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology team, which is led by our Vice President, Digital Operations & Facilities, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct cybersecurity audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: Regular Audits and Monitoring: The Company conducts periodic audits and continuous monitoring of systems intended to detect any anomalies or potential security breaches. This involves using advanced tools to monitor network traffic and behavior for suspicious activities.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: The risk committee of our Board is primarily responsible for oversight of risks, including those from cybersecurity threats, and is currently chaired by a director with extensive functional expertise in cybersecurity matters. Members of management, including our Chief Technology Officer, provide the risk committee updates on cybersecurity risk matters on a quarterly basis and more frequently if circumstances dictate. In these updates, members of the risk committee are apprised of cybersecurity incidents that are deemed to have had a moderate or higher impact even if immaterial to us. In addition, the risk committee reviews and actively discusses with management and among themselves the risks related to cybersecurity and critical systems in order to provide input on the appropriate level of risk for our company and reviews management's strategies for adequately mitigating and managing the identified risks. The risk committee and management regularly update our full Board with respect to cybersecurity matters.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: If a cybersecurity incident is deemed to have the potential for a material impact on the Company, our Incident Response, Reporting and Management Policy dictates procedures for promptly briefing the Audit Committee. In addition, our CIO reports all cybersecurity incidents, whether ongoing or first experienced during the quarter, to the Audit Committee at each quarterly meeting, and more frequently if necessary.

companyName: Installed Building Products, Inc.

ticker: IBP


text: Employees are one of our most valuable resources and it is essential that education, particularly related to social engineering, is persistent and relevant. The Company requires ongoing cybersecurity awareness training for all employees, including weekly simulated emails to test the knowledge and reaction of employees. The training is, customized based on actual events or anticipated emerging threats, keeping the education applicable and purposeful.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Any incident identified by the management executive committee as having a material impact would be promptly escalated to all members of the Board of Directors. Should there be an incident which does not rise to the level of being material, such incident would, at minimum, be included in the subsequent IT reports to both the management executive committee and the Board of Directors. We believe we are appropriately staffed to support a healthy cybersecurity posture.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition.

companyName: Sterling Bancorp, Inc.


text: We regularly engage third party service providers to assist with management of cybersecurity risks. For instance, as noted above, we engage third parties to conduct frequent, independent vulnerability and penetration testing of our systems. In addition, in 2023 and 2024, we engaged Grant Thornton LLP to conduct a SOC 2 audit of our systems and controls. Further, our enterprise level IT general controls are audited annually by our independent registered public accounting firm.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: The Risk Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Risk Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews quarterly reports regarding the information security program and technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. Results of this testing is included in the Company's SOC report. Further, we also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.

companyName: CANTALOUPE, INC.

ticker: CTLP