text: Our information security program is managed by our interim Chief Information Security Officer (CISO), who reports to our Chief Technology Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our foundational security engineering, governance risk and compliance, product security and security operations teams report into our interim CISO and provide regular updates on significant or potentially significant threats and incidents. Our interim CISO has nearly 20 years of experience serving in information security roles in healthcare and technology companies.

companyName: BILL Holdings, Inc.

ticker: BILL


text: During the fiscal year ended June 30, 2025, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See "Security breaches, loss of data and other disruptions have in the past and could in the future compromise sensitive information related to our business or our participants, or prevent us from accessing critical information and expose us to liability, and could adversely affect our business and our reputation " in Item 1A "Risk Factors" in this Annual Report.

companyName: InnovAge Holding Corp.

ticker: INNV

secItem: Item 1C


text: To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition.

companyName: iCoreConnect Inc.


text: 1.Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. 2.Assessment of the likelihood and potential damage of these threats, taking into consideration the sensitivity of confidential information. 3.Assessment of the sufficiency of policies, procedures, information systems, and other arrangements in place to control risks.

companyName: First Financial Northwest, Inc.


text: In an effort to deter and detect cybersecurity threats, we periodically provide all employees with a cybersecurity training and compliance program, which covers timely and relevant topics and educates employees on the importance of reporting immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.

companyName: Mural Oncology plc


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through regular privacy and security training and testing to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: authID Inc.

ticker: AUID


text: Human Layer: We realize that the users of the information assets are the first line of defense and cyber risk prevention is every INSW employee's responsibility. We organize mandatory cybersecurity awareness training for all staff yearly and conduct simulation tests monthly to check employee preparedness in the detection of phishing attacks. We also maintain an IT Security Policy and Procedures document, that describes Company security policy and practices in detail.

companyName: International Seaways, Inc.

ticker: INSW


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, including incident response personnel, and senior management;

companyName: Stride, Inc.

ticker: LRN


text: Our Response Plan is designed to ensure that cybersecurity incidents that have had or are reasonably likely to have a material effect on our business strategy, financial condition, and results of operations are promptly escalated to relevant executive officers, including our Senior Vice President, Chief Legal Officer, for further assessment of potential materiality and, if appropriate, notification to other members of our senior management team, the chairperson of the audit committee of our board of directors, or the Audit Committee, and the full board of directors, as needed, and preparation and dissemination of public disclosure.

companyName: Mersana Therapeutics, Inc.


text: Our information security team has many years of experience implementing cybersecurity at technology and research and development companies, and together with our internal information security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: QuantumScape Corp

ticker: QS


text: Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our regularly scheduled Board meetings, the CISO and the CIO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Systems and process monitoring are essential components of our cybersecurity risk management and information security programs. Management utilizes industry standard tools and procedures to monitor the information security of systems, networks and information assets, regardless of geographic location, and has implemented key policies and procedures, including but not limited to cybersecurity threat detection and analysis, a framework for materiality determination and a reporting-up process to assist in a disclosure of a material event, if required. In addition, management has defined key roles and responsibilities within our organization to handle material cybersecurity incidents. A comprehensive incident response plan is utilized for any threat activities identified, including timely containment, analysis, remediation, and communication, and is also applicable to third parties with access to our information systems or assets. We have implemented security programs, such as mandatory cybersecurity awareness training for all our employees, simulated phishing emails and tabletop exercises, that are strategically designed and continuously updated to address evolving cybersecurity threats and latest industry trends. These programs, which are held multiple times a year, allow our employees to both identify and address material cybersecurity incidents, utilizing our comprehensive incident response plan.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: We maintain a cybersecurity risk management program as part of the Company's overall risk management framework and related policies and processes to identify, assess and manage material risks from cybersecurity threats.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: We manage risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, through our overall enterprise risk management process, which is overseen by our Board. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Marriott's policies, procedures, and processes generally follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Under the oversight of the CIDO, members of the Company's Information Technology and Compliance departments administer the Company's cybersecurity response policies, including assessing cybersecurity incidents as they occur and determining the severity of any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policies. These teams report to an incident response governance team, which is composed of members of the Company's senior leadership team. These teams monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report incidents to the Audit Committee, as appropriate.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: Our management team, specifically the chief executive officer and the chief financial officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including its third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: We also engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes to assist us in our design and implementation of our cybersecurity policies and procedures and in our assessment and testing of our security safeguards. This includes a third-party managed detection and response team (MDR) to conduct ongoing network monitoring and to support incident management and threat assessment. Additionally, as a public company, we are subject to regulatory requirements and undergo audits of our financial statements, which include a review of related cybersecurity controls and information technology systems.

companyName: Absci Corp

ticker: ABSI


text: Our Board of Directors, along with our Information Technology Committee, which is comprised of key members of senior management, are actively involved in providing oversight of our cybersecurity program. Monthly updates are provided to our Board regarding the status of our program, including key monitoring metrics and trends noted both internally and within our industry. Our Board reviews and approves all cybersecurity-related risk assessments, polices and formalized reviews performed throughout the year.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: Risk Management Strategies Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program ("Cybersecurity Program") that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of our integrated risk management process and includes, but is not limited to, the following features: • Regularly simulated phishing attacks and comprehensive cybersecurity training for all employees, with special focus on high-risk individuals using a new security awareness platform. • Cybersecurity insurance coverage to mitigate financial impacts from potential cyber incidents. • Endpoint detection and response technologies (EDR) to monitor systems continuously for malicious activity. • Behavior analytics tools that help track normal behavior patterns and quickly detect any anomalies. • Cloud security measures, offering comprehensive protection and vulnerability management for our cloud environments. • Digital risk protection that includes brand protection, social media monitoring, dark web surveillance, and proactive response to phishing, fraud, and account takeovers. • Zero-day vulnerability management, with third-party monitoring to prioritize critical vulnerabilities based on real-time risk assessments and active exploitation. • Comprehensive vendor risk management program, including penetration tests, Service Organization Control ("SOC") reports, and security architecture reviews, especially for third parties managing sensitive data or accessing internal systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Our Security Incident Response Plan (SIRP) governs the procedure for cybersecurity event escalation and notification practices. The plan uses a methodology that closely follows the "Incident Response Life Cycle" published in NIST 800-61 "Computer Security Incident Handling Guide" to manage cybersecurity incidents. In addition to managing the technical response to cybersecurity incidents using this methodology, this plan also addresses non-technical response requirements. Non-technical responses include engaging the proper Centuri personnel to determine the compliance, regulatory, legal, corporate communication, and other requirements we need to comply with to address the cybersecurity incidents.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: The Company uses various tools to prevent, detect, and mitigate cybersecurity incidents. The Company has procedures in place to respond to cybersecurity incidents, which include prompt meeting of the Cybersecurity Incident Disclosure Committee, a Company management committee, to assess cybersecurity incidents and determine materiality requiring disclosure on Form 8-K, notification of the Board of Directors of any material cybersecurity incidents, quarterly reporting by the Chief Information Security Officer of material and non-material incidents to the Risk Oversight Committee and management, and to the Audit Committee of such incidents related to the Company's financial systems.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Our privacy and cybersecurity policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our Information Technology, Privacy, Product, and Operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed privacy and cybersecurity laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Like most technology companies, we have suffered cybersecurity incidents in the past and expect that we may face cybersecurity incidents in the future. As of the date of this report on Form 10-K, however, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For additional information about the cybersecurity risks that we face, please see the discussion in Item 1A. "Risk Factors" in this annual report on Form 10-K, including the risk factor entitled "Business, Financial and Operational Risks; Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability."

companyName: Oportun Financial Corp

ticker: OPRT


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive.

companyName: US BANCORP \DE\

ticker: USB


text: Specific controls that are used to some extent as part of the information security program include endpoint threat detection and response, privileged access management, logging and monitoring involving the use of security information and event management with monitoring by a security operations center, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability and patch management, and security awareness training for employees and long-term consultants. Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct independent assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: GUESS INC

ticker: GES


text: We rely upon information technology networks and systems to process, transmit, and store electronic information, and to manage or support virtually all of our business processes and activities. We also use mobile devices, social networking, and other online activities to connect with our employees, suppliers, business partners, and customers. Accordingly, we maintain a comprehensive Information Security Program, anchored in a multi-tiered, defense-in-depth strategy designed to identify and mitigate risks from cybersecurity threats. We believe that our Information Security Program aligns with industry frameworks and assesses security trends, and facilitates identification and reduction of vulnerabilities. Our cybersecurity strategy considers existing risks to our company and those that we are likely to encounter based on our industry, company profile, and business objectives. Consideration of risks from cybersecurity threats is a key component of our overall enterprise risk management strategy.

companyName: Performance Food Group Co

ticker: PFGC


text: Our Information Systems function, led by our Vice President for Information Systems and Director of Information Systems, helps identify, assess and manage the Company's cybersecurity threats and risks. Our Information Systems function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats, conducting scans of the Company's threat environment, evaluating threats that are reported to us, conducting internal audits, internal threat assessments, and conducting vulnerability assessments.

companyName: DBV Technologies S.A.

ticker: DBVT


text: we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: TFF Pharmaceuticals, Inc.


text: We have a formalized incident response plan (IRP) and associated procedures based on cybersecurity best practices which are refined using the information gained through testing and to further improve our cybersecurity preparedness and response infrastructure. These plans and procedures set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.

companyName: N-able, Inc.

ticker: NABL


text: We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks. In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats.

companyName: Renalytix plc

ticker: RNLXY


text: Management and Strategy. Mexco recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an important component of our overall risk management strategy. Mexco's cybersecurity team consists of our executive officers and third-party cybersecurity personnel. The third-party cybersecurity team, led by professionals with cybersecurity expertise across multiple industries, takes a cross-functional approach to addressing these risks and engages in discussions with our executive management team have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. We also require our employees to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises to test the effectiveness of our incidence response plan ("IRP") and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: MEXCO ENERGY CORP

ticker: MXC


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes reviews with our technology partners who provide the commercial off the shelf software applications we rely on to deliver business services.

companyName: VINEBROOK HOMES TRUST, INC.


text: At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to MongoDB Atlas, which is certified against ISO 27001:2013, ISO 27017:2015, ISO 27018:2019, SOC 2 Type II, Payment Card Industry Data Security Standard v.4, and Cloud Security Alliance ("CSA") Security, Trust, Assurance, Information Security Registered Assessors Program and Risk ("STAR") Level 2. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.

companyName: MongoDB, Inc.

ticker: MDB


text: In addition to the CGNC's oversight, senior management of the Company's business units are responsible for the day-to-day operations of protecting their businesses' information systems. Each business unit is required to report material cybersecurity events to the Company. The Company's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Evaluation, Categorization, and Escalation of Cybersecurity Incidents Our information security program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incidents, including to the attention of the Technology Committee as appropriate. The incident response plan is approved annually by the board of directors. We maintain a Global Security Operations Center ("GSOC"), staffed 24/7, and a Global Critical Incident Management ("GCIM") team, and the roles and responsibilities of the GSOC and GCIM in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation. On an annual basis, we retain an outside consultant to develop and administer a simulation of a cybersecurity incident designed to test our response capabilities and capacity for effective cross-functional coordination in the wake of an incident and to inform management and the Technology Committee of the results of the exercise. We maintain a business resiliency program, overseen by the BRG team, that is designed to facilitate our ability to respond, recover and resume services in the event of an incident that causes an operational disruption.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Through its Audit Committee, the Board oversees the Company's ERM program, including risks arising from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks addressing recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives information regarding cybersecurity incidents impacting the Company that are deemed more significant under the cybersecurity incident response plan, as well as ongoing updates regarding any such incidents until they have been addressed. The Audit Committee discusses the Company's approach to cybersecurity risk management with GATX senior management, including the CIO and the Global Head of IT Security, who reports to the CIO and has responsibility for assessing and managing material risks from cybersecurity threats.

companyName: GATX CORP

ticker: GATX


text: GoHealth's services involve the collection, processing, use, storage and transmission of confidential and personal information of consumers and employees. Maintaining the integrity, confidentiality and availability of this information as well as the information technology systems in which the information resides is critical to the Company's operations and business strategy.

companyName: GoHealth, Inc.

ticker: GOCO


text: Our Board of Directors (the "Board") addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the Chief Information and Digital Officer and CISO. In addition, on at least an annual basis, the Board receives reports, summaries or presentations from our Chief Information and Digital Officer and CISO related to cybersecurity threats, risk, mitigation and related processes.

companyName: CNH Industrial N.V.

ticker: CNH


text: In addition, cybersecurity risk is a fundamental risk of the Company which is overseen by the Risk Committee of the Board, which consists of the entire Board, including Directors with experience in risk management, internal audit, cybersecurity and/or the operations of financial service companies. In particular, the Chair of the Board, Eric E. Stickels, has experience with the risks associated with operating a financial institution based upon his prior service as the President of Oneida Financial Corp. In addition, Lead Director Susan E. Skerritt, the former Chief Executive Officer and President of Deutsche Bank Trust Company Americas, has received the Cyber-Risk Oversight Certification issued by the National Association of Corporate Directors ("NACD"), and utilizes her business experience and cyber-risk expertise to assist the Risk Committee in its evaluation of management's cybersecurity process. Kerrie D. MacPherson, the Chair of the Audit Committee, has also received the Cyber-Risk Oversight Certification issued by the NACD. Mark E. Tryniski, the Company's former President and Chief Executive Officer, serves on the Board and has considerable experience in the management of financial service companies and the cybersecurity process based upon his service with the Company. Director Jeffery J. Knauss has also been selected by the Board to serve on the IT Steering Committee as its representative due to his technology experience developed through his ownership and management of a digital marketing firm. Director Knauss plays a valuable role in the oversight of the IT Steering Committee and is able to impart his knowledge and experience to the committee.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: The cybersecurity function is centralized under the Senior Vice President and Chief Information Officer, who has over three decades of experience in information technology. The cybersecurity function is comprised of a dedicated team of professionals who work continuously to monitor risks relating to cybersecurity resilience strategy, policy, standards, architecture, and processes. We identify and address cybersecurity risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements. This requires a comprehensive program involving advanced monitoring and defense technology along with recurring situational drills that exercise incident response and crisis management plans. We leverage dedicated internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. In the event a cybersecurity incident occurs, we maintain cybersecurity insurance to provide appropriate resources for both financial and cyber expertise. We have partnerships for penetration testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our technology environment.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer and research data or sales information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of artificial intelligence. We have not experienced cyberattacks in the past, and there can be no guarantee that in the future such cyberattacks will not be material. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts. In addition, cybersecurity incidents could have material adverse effects on our business strategy, financial condition, and results of operations (e.g., a significant breach could result in direct financial losses due to fraud, system downtime impacting revenue generation, increased compliance costs or contractual liabilities with third-party vendors and customers).

companyName: PMGC Holdings Inc.

ticker: ELAB


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate technology risk, including our corporate IT control system, to work towards a consistent minimal level of cybersecurity across all our subsidiaries. We engage in periodic or regular monitoring and assessments of our technology key infrastructure and processes using internal staff and third-party specialists utilizing methods such as penetration testing, vulnerability scanning, code, configuration reviews. risk and security assessments. We assess and manage risks, including IT and cybersecurity risks, associated with external service providers and our supply chain, utilizing methods such as security assessments, SLAs, information security and data protection contractual clauses. Our audit procedures include testing of IT and cybersecurity controls to ensure reliability. The type, maturity, and formalization of controls in our subsidiaries is informed by the level of anticipated threats and their impacts associated with each organization.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership and subject to oversight by the Information Technology and Security Committee of our Board of Directors. Our cybersecurity program is managed by our Senior Director of IT & Information Security, who is a Certified Information Systems Security professional (CISSP) and reports to our Chief Operating Officer. Our Chief Operating Officer and Senior Director of IT and Information Security provide periodic briefings about our cybersecurity risk management to the Information Technology and Security Committee.

companyName: NLIGHT, INC.

ticker: LASR


text: As part of our cybersecurity risk management system, our IT management team tracks and logs privacy and security incidents across our OEM partners, Microsoft and Oracle and other IT system providers, our vendors, and other third-party service providers to remediate and resolve any such incidents. Any significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to designated members of our senior management. We would consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosures and other compliance decisions. Our management is tasked with apprising TSS' independent public accounting firm of matters and any relevant developments.

companyName: TSS, Inc.

ticker: TSSI


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents see Item 1A, "Operational Risks – Security breaches, computer malware or other cyberattacks involving the confidential information of our customers, employees or business partners could substantially damage our reputation, subject us to litigation and enforcement actions, and substantially harm our business and results of operations."

companyName: DELUXE CORP

ticker: DLX


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our management, including the Chief Technology Officer of the Manager.


text: Board of Director Oversight The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ( "CISO") and Chief Information Officer ("CIO ") regularly. The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed.

companyName: MOSAIC CO

ticker: MOS


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our Board of Directors (the Board) considers cybersecurity risk as part of its risk oversight function and the Audit Committee (the Committee) contributes to oversight of cybersecurity risks.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: We maintain a Data Privacy & Security working group that is responsible for setting data security and privacy policies, overseeing those policies, and tracking and reporting on data security and privacy performance. The working group is comprised of our Chief Information Security Officer, Global Data Privacy Officer, Chief Administrative Officer, and General Counsel. The working group reports to the Audit Committee at least annually. In addition, the Company has an Impact Committee that maintains functional working groups that focus on a number of issues, including Data Privacy & Security. The Impact Committee reports to the Board at least annually. The Company's Global Data Privacy Officer reports to the Audit Committee at least quarterly and provides the Audit Committee with updates regarding the Company's data privacy environment. We also have a Chief Information Security Officer who provides quarterly updates to management and reports to the Audit Committee at least annually regarding the Company's data security environment.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: Relevant Expertise of Management: Our CISO has more than 20 years of intelligence, information technology and cybersecurity experience, and holds a Masters degree in the area of Cybersecurity and Information Sciences from The Pennsylvania State University as well as a Graduate Certificate from The Pennsylvania State University in Information Systems Cybersecurity and a current Certified Information Security Manager certification from ISACA. His prior roles include senior level positions in Defense, Financial Services and High Technology industries. Our CIO has more than 30 years of information technology and cybersecurity experience at various levels. She holds an executive MBA from the Quantic School of Business and Technology, a Graduate Certificate in SAP from Central Michigan University, a Masters in computer information systems from Grand Valley State University and a BA from the University of Michigan. Her prior roles include positions as Chief Information Officer and Vice President of Information Technology and Digital Office of Adient plc, a global automotive seating manufacturer, and Chief Information Officer and Vice President of Information Technology, Power Solutions of Johnson Controls.

companyName: Vertiv Holdings Co

ticker: VRT


text: Our executive management team, with regulatory and governance oversight from our Audit Committee, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Digital and IT Steering Committee is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems.

companyName: Kandi Technologies Group, Inc.


text: As one of the critical elements of the Company's overall risk management and compliance approach, the Company's cybersecurity program is focused on the following key areas:

companyName: Passage BIO, Inc.

ticker: PASG


text: Processes for Monitoring Cybersecurity Our cybersecurity oversight committee maintains rigorous processes to remain informed and responsive to the ever-changing landscape of cybersecurity. These processes include: The creation and management of secure user accounts within our Monogram email Google Workspace, ensuring controlled email communication. The establishment of access controls to Google Drive and Bitbucket, safeguarding our product-related documents and software development repositories. Subscription to Amazon Web Services for secure storage of our mechanical drawings and electrical schematics. Utilization of Green Light Guru for maintaining a repository of all released and quality documents. Oversight of bill.com and NetSuite for financial operations and inventory management, ensuring secure financial transactions and data integrity.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our Chief Information Security Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: tabletop exercises, vulnerability management programs, internal & external security risk assessments, threat modeling processes of new services, third party security risk functions, incident response processes, phishing awareness programs, and additional control validation services.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: The goal of the Company's cybersecurity risk management strategy is to mitigate cybersecurity risks. Cybersecurity risks include the potential misappropriation of assets or confidential information, corruption of data, disruptions to operations, or regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure, and similar threats that could have a material impact to the Company's business, reputation, results of operations and financial condition. To this end, management has implemented processes which seek to identify, assess, and manage material cybersecurity risks, and which include (i) monitoring of cybersecurity threats in the current environment, (ii) training employees on a regular basis in cybersecurity prevention, including social engineering and phishing techniques used by hackers, (iii) requiring multifactor authentication to access the Company's networks, (iv) updating applications on an on-going basis to patch or remediate security vulnerabilities, and (v) the encryption of confidential data and critical servers. The Company has in-place security information and event management tools for the purpose of detecting, analyzing, and responding to security threats in an effort to prevent or reduce potential harm to business operations. These tools include: (i) antivirus applications to detect threats, (ii) end point detection and response applications to record and store on-line user behavior for the purpose of detecting, investigating, and blocking suspicious activities, and (iii) third party monitoring applications. The Company has also adopted a network segmentation strategy intended to divide networks into smaller parts to improve security and efficiency, and the Company also maintains redundant back-up copies of its networks that are stored in multiple locations, including cloud-based backups that are performed daily. Further, on an annual basis, the Company hires a consultant to perform penetration tests against the Company's security infrastructure with the goal of identifying security vulnerabilities and making recommendations for security improvements. The Company also has business continuity and incident response programs in place to respond to and mitigate cybersecurity attacks. The Company conducts periodic exercises in an effort to improve its cybersecurity business continuity and incident response plans and updates the plans if new threats are identified or ongoing reviews of the plans suggest an update is needed.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: We have implemented cybersecurity policies, processes, and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Security Operations team scans the infrastructure, monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets, their sensitivity and potential threats, followed by assessing and prioritizing risks. We employ various tools and techniques like threat modeling, vulnerability scanners, and penetration testing. Based on the assessment, security measures are planned, prioritized and implemented. We have implemented regular security awareness training programs for employees to educate them on cybersecurity best practices and to recognize social engineering and phishing attempts. We also assess and manage cybersecurity risks associated with relevant third-party service providers, including those in our supply chain or who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and keep abreast of a dynamic and continuously evolving threat landscape.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: Our business strategy, results of operations and financial condition have not to date been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see the section titled "Risk Factors" set forth in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Weave Communications, Inc.

ticker: WEAV


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Cybersecurity and Technology Subcommittee has oversight responsibility for cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board holds periodic cybersecurity education sessions, which may feature the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level crisis exercise that includes a cybersecurity component to test its resiliency response, completeness of playbooks, and communication protocols. This exercise involves Board members, Managing Committee members, third-party companies, and regulators, as appropriate.

companyName: US BANCORP \DE\

ticker: USB


text: The Chief Information Security Officer (CISO), who reports to the Chief Information Officer (CIO), is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the information security team, and through the use of technological tools and software and results from third-party audits. The CISO has a clear escalation path to senior management for cyber-related events.

companyName: AVIENT CORP

ticker: AVNT


text: We design, assess and benchmark our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: ARDELYX, INC.

ticker: ARDX


text: We are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems. Accordingly, security incidents are evaluated, classified by severity and prioritized for response, mitigation and remediation. From a high level, our incident response framework consists of five elements: (1) proactively identifying and appropriately managing cybersecurity risks to our systems, assets, data, and other capabilities; (2) designing and implementing the appropriate safeguards to timely deliver business services; (3) implementing systems and processes to detect the occurrence of cybersecurity events; (4) responding to events in a systematic and comprehensive fashion; and (5) utilizing mechanisms to promote system resilience and the restoration of critical business functions that may have been impaired due to a security incident.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: Our board of directors oversees the Company's risk management program, including our cybersecurity program, both directly and through several committees created as part of our risk governance program. Specifically, the Audit Committee of the board, in conjunction with the Regulatory Committee (the "Regulatory Committee"), which focuses on the risk structure and governance related to regulatory risk throughout all lines of business, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings and Regulatory Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the CISO and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed. Additionally, we have protocols by which certain cybersecurity incidents are escalated in a timely manner to the Audit Committee and the board of directors.

companyName: Rithm Capital Corp.

ticker: RITM


text: Our approach to cybersecurity is proactive and multifaceted, combining the scalability and reliability of the Microsoft cloud services with the agility and expertise of our third-party cybersecurity partner. Together, these resources form a comprehensive defense mechanism against a wide range of cyber threats, from phishing and malware attacks to sophisticated nation-state sponsored cyber-attacks. We continuously evaluate and adapt our cybersecurity strategy to respond to evolving threats and to align with best practices and regulatory requirements.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: The Company Risk Committee ("CRC") serves as the management committee responsible for Information Security oversight and the CISO is a member of the committee. The Risk Oversight Committee ("ROC") is a sub-committee of the Board of Directors (the "Board") and provides direct oversight of Information Security on behalf of the Board. Director Kim E. VanGelder, the current Chair of the ROC, has served as a member of our Board since 2016, and has held progressive information technology leadership roles at the Eastman Kodak Company, with responsibilities including cybersecurity, global applications, and global technology infrastructure, and has served as its Chief Information Officer since 2004.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: The Board of Directors recognizes the importance of maintaining the trust and confidence of our tenants/borrowers/operators and employees to safeguard sensitive information and the integrity of our information systems. We have systems in place to assess, identify and manage cybersecurity incidents and we invest in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents. We have maintained a strong focus on consistently reviewing our cybersecurity practices. We also conduct periodic information security and awareness training to ensure that employees are aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we also take steps designed to provide appropriate guidance regarding security to our executive management and employees, including any employee who may come into possession of confidential financial information.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: ACNB engages independent third-party assessors and auditors in connection with its information security program, including to conduct external and internal penetration testing and internal vulnerability scanning, independent audits and risk assessments. Technology Services personnel perform internal security practices, including periodic internal vulnerability scanning using commercial software tools and follow-up with corrective measures as required, monitoring for unauthorized access attempts, uses dynamically updated Endpoint Security for anti-malware, and deploying dynamically updated firewalls to protect against unknown actors. The Information Security Officer performs monthly phishing exercises with the reporting of results to the Information Security Committee and an annual summary of results to the Audit Committee. ACNB Bank also utilizes third-party service providers in the ordinary course of business. As part of ACNB Bank's management program, initial and ongoing information security due diligence is reviewed and assessed on ACNB Bank's service providers as appropriate, based on level of access to, storage of and processing of corporate and customer confidential information. Such due diligence may include review of service organization control reports and other independent testing, information security and incident response programs.

companyName: ACNB CORP

ticker: ACNB


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. See Item 1A – Risk Factors" of this Form 10-K for additional information on cybersecurity risks.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: The Company has an Enterprise Risk Management ("ERM") Committee and process in place that reviews and evaluates the overall risks to the Company, including its cybersecurity risks. The ERM process has the input of senior management and other internal stakeholders, and the cybersecurity risk management process is incorporated into our ERM review. Cybersecurity risks to the Company are reviewed, evaluated, and discussed on a quarterly basis and, when necessary, on an ad-hoc basis with our Executive Committee and other members of the management team.

companyName: CONSTELLIUM SE

ticker: CSTM


text: The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. Specific topics may include updates to our company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. The Board of Directors receives regular reports from the Audit Committee chair on these and other risk-related matters as deemed necessary. Our CISO or other members of management provide information to the Audit Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed established reporting thresholds.

companyName: Walmart Inc.

ticker: WMT


text: Chief Technology Officer oversees our cybersecurity policies and processes and will provide periodic briefings to the Chief Executive Officer, the Audit Committee and/or the Board of Directors as needed regarding any material cybersecurity risks or activities, including any recent cybersecurity incidents and related responses.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: The Vendor Management team ensures compliance with the organization's Vendor Management Policy, including initial and ongoing due diligence of all third -party providers.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Company conducts an annual cybersecurity risk assessment and reports the most significant risks and associated planned mitigation strategies to the Audit Committee of the Board of Directors. The annual risk assessment is carried out under the supervision of the Executive Vice President of Business Services and General Counsel, the President of Nucor Business Technology, the Company's Cybersecurity Director, and the Company's Vice President and Corporate Controller. See "Governance" below. The Board also regularly receives focused presentations regarding cybersecurity risks from the Company's Cybersecurity Director.

companyName: NUCOR CORP

ticker: NUE


text: The SOMC and SRMC are comprised of senior leadership and executive-level officers, including FHLBank's CRO and Chief Information Officer. The SOMC is responsible for receiving reports on issues escalated from the Technology Committee. The SRMC is responsible for management of operational risk and implementation of the cybersecurity risk management framework within the ERM Program as approved by the board of directors and receives reports on issues escalated from the ORC.

companyName: Federal Home Loan Bank of Topeka


text: Despite our efforts, we can offer no guarantees that the cybersecurity measures we use will prevent unauthorized or malicious access to ACV systems and information. For more information regarding the risks relating to cybersecurity, see "Risk Factors—Risks Related to Information Technology and Intellectual Property—Security breaches, cyber-attacks or other similar incidents with respect to our information technology systems, or those of our third- party service providers, could result in adverse consequences, including, but not limited to, a disruption of our business operations; reputational harm; loss of revenue or profits; regulatory investigations or actions; litigation; fines and penalties. If we fail to comply with our commitments, assurances or other obligations regarding data privacy and security, our reputation may be harmed and we may be exposed to liability; loss of business; and other adverse business consequences."

companyName: ACV Auctions Inc.

ticker: ACVA


text: We have developed an enterprise-wide strategy that we use to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Our enterprise risk management program incorporates risks related to cybersecurity threats alongside other company risks as part of our overall risk assessment process. We also employ a cybersecurity-specific risk assessment process.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: Our IT department is tasked with evaluating and addressing cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats and engage outside providers to conduct periodic internal and external penetration testing.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. Despite our efforts, we cannot guarantee that our security measures and controls will be sufficient or effective to prevent, detect, or mitigate all cybersecurity incidents or to protect our systems and data from unauthorized access, use, or disclosure. We may experience cybersecurity incidents in the future that could result in operational disruption, reputational damage, customer dissatisfaction, loss of business or revenue, legal liability, regulatory actions, fines, penalties, or remediation costs.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Our third party service provider, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller reporting Company, we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: HeartSciences Inc.

ticker: HSCS


text: While we are in the process of fully implementing a comprehensive cybersecurity risk management program, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AIRGAIN INC

ticker: AIRG


text: Key aspects of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Our cybersecurity plan, strategy, policy, standards, and processes are aligned with common security risk management framework and practices, including detailed tasks, plans and initiatives, which are reviewed and updated annually and periodically.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.

companyName: OFS Capital Corp

ticker: OFS


text: The Board of Directors has delegated the oversight of risks from cybersecurity threats to the Audit Committee, which has delegated authority to the Chief Financial Officer to oversee the Company's day-to-day cybersecurity risk management, including prevention, detection and responding to any suspected cybersecurity incident.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and We had no material cybersecurity incidents in 2023.

companyName: Village Bank & Trust Financial Corp.


text: The audit committee receives regular reports from management on our cybersecurity risks. In addition, management updates the audit committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The audit committee reports to our full board of directors regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management on our cyber risk management program.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors" under the heading "General," which should be read in conjunction with the foregoing information.

companyName: CUMMINS INC

ticker: CMI


text: Dr. Thomas Frank, Executive Vice President and Chief Information Officer: Dr. Frank has been with the Company since 1985 and was instrumental in the development of the Company's early market making systems. Dr. Frank became Chief Information Officer in 2006. Dr. Frank is responsible for the Company's technical infrastructure and operations and information security, among other duties. Dr. Frank is a member of the Board of Directors of OCC. Dr. Frank received an S.B. and a Ph. D. in Physics from the Massachusetts Institute of Technology.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Management is also responsible for the testing of the overall security posture and the documentation of risk management and security for regulatory examinations and for regular review of security and privacy requirements. In addition to our internal cybersecurity team, our company has retained a third-party security firm to aid in the identification, containment, eradication and recovery of systems, data or both in the event of a material security incident.

companyName: Frontdoor, Inc.

ticker: FTDR


text: As discussed in Part I, Item 1A, "Risk Factors," under the heading "Financial/Accounting Risks – We may not have adequate insurance for potential liabilities and insurance may not cover certain liabilities," we maintain cyber risk insurance to mitigate our exposure to these threats.

companyName: Civeo Corp

ticker: CVEO


text: Wolfspeed's Senior Director of Information Security leads our InfoSec GRC organization and is responsible for the implementation, operation, and monitoring of our cybersecurity risk management program. Our Senior Director of Information Security reports to the CIO, who reports to the Executive Vice President, Chief Financial Officer. The Senior Director of Information Security has over 16 years of experience in the cybersecurity space and has completed advanced training in the fields of cybersecurity and technology.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Monitor Cybersecurity Incidents Our DIT is continually informed and updated on the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. Our DIT, supported by our DIS, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan, which details immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Risks from Cybersecurity Threats As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information, see Item 1A. Risk Factors.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Cybersecurity threats have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while we are strategically focused on pursuing FDA approval and have pre-commercial operations.

companyName: Microbot Medical Inc.

ticker: MBOT


text: Currently, Jack Wang, our chief information officer of our subsidiary PeriShip Global, has primary responsibility for managing material cybersecurity risks over our Precision Logistics Segment while Paul Ryan, Executive Vice President, Authentication Segment, has the primary responsibility for assessing and managing material cybersecurity risks over our Authentication Segment. Mr. Wang holds an undergraduate and master's degree in computer science. Our CIO has served in various roles in information technology and security for over 20 years. Mr. Ryan has 30 years of experience in global software and technology businesses. Both Mr. Wang and Mr. Ryan are responsible for reporting any cybersecurity related incidents to our executive officers. Our executive officers are responsible for reporting material cybersecurity related incidents to our Board of Directors.

companyName: VerifyMe, Inc.

ticker: VRME


text: Employee cybersecurity training and phishing email training are required for all employees and is performed monthly to continually enhance awareness and responsiveness.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: As of the date of this filing, we do not believe that there currently are or have been any cybersecurity incidents, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information on risks related to cybersecurity threats, please see Part I, Item 1A, "Risk Factors."

companyName: KADANT INC

ticker: KAI


text: The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a cybersecurity incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: To operate our business, we rely upon certain third-party service providers (the "Providers") to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We are in the process of developing vendor management processes designed to help to manage cybersecurity risks associated with our use of these Providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the Provider, our vendor management process may include i) reviewing the cybersecurity practices of such Provider;ii) requiring their completion of written questionnaires regarding their services and data handling practices; and iii) obtaining a Security Operations Center ("SOC") report for the Provider's internal control structure. For our largest third-party provider, our Contract Research Organization ("CRO") which is helping us manage our clinical trial(s), we will conduct a comprehensive security assessment and review, including their cybersecurity practices, protocols and protections and physical security.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Business continuity – Managed data backup utilizing best practices including cloud based disaster recovery, security protection – Real-time protection against security threats across email, browsers, files, and infrastructure resources, management – Patching for Windows and certain third party application updates, monitoring – 24x7 monitoring, alerting and maintenance of various office and cloud systems.

companyName: MAYS J W INC

ticker: MAYS


text: We use a layered defense management approach to managing cybersecurity. The Bank's cybersecurity operations function is headed by the Director of IT who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The Director of IT oversees a team of internal and external security professionals in safeguarding our critical data, systems, and assets against threats, breaches, and attacks. The Director of IT is also responsible for ensuring the confidentiality, integrity, and availability of information assets.

companyName: Bogota Financial Corp.

ticker: BSBK


text: In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.

companyName: Ampio Pharmaceuticals, Inc.

ticker: AMPE


text: We are a "blank check" company whose business plan is to merge with an operating company, and, in addition, as a "shell company" we have no or nominal assets (other than cash) and no or nominal operations. Accordingly, we do not have material information to disclose regarding our cybersecurity risk management, strategy and governance.

companyName: Stratos Renewables Corp

ticker: SRNW


text: Our VP IT, the Director of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: IMO MSC-FAL.1/Circ.3/Rev.2 BIMCO's Guidelines for Cyber Security Onboard Ships IAPH's Cybersecurity Guidelines for Ports and Port Facilities In addition, Matson participates in the following organizations in its effort to better understand best practices and advance its systems and policies over time:

companyName: Matson, Inc.

ticker: MATX


text: Risk Management and Strategy MPC has processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity and availability. These enterprise-wide processes are based upon policies, practices and standards that guide MPC on identifying, assessing and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in MPC's centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces and provide flexibility and scalability in MPC's ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.

companyName: MPLX LP

ticker: MPLX


text: Before initiating a third-party service provider, Terex's GCG performs a thorough assessment of its cyber security measures including a review of the third-party provider's information security policy, service organization control report(s), architectural diagram(s) and an overview of its cyber security program. It is also our practice to negotiate breach notification clauses into our IT vendor contracts for vendors who are hosting or storing any Terex information.

companyName: TEREX CORP

ticker: TEX


text: The Company has also implemented various safeguards to protect the availability of its data and the integrity of its network, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect the Company's on-site data center, and electrical power protection and generation facilities. The Company also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.

companyName: SITE Centers Corp.

ticker: SITC


text: Our Board understands the critical nature of managing risks associated with cybersecurity threats. Accordingly, our Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and in maintaining shareholder confidence. The Audit Committee has been made primarily responsible for the Board's oversight of cybersecurity risks. However, the entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues. Our Chief Information Officer is responsible for overseeing cybersecurity and reports to the Audit Committee, as well as the Board at all its regular quarterly meetings regarding matters of cybersecurity. These reports include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), updating the status on defensive security measures and risk assessment, and key information security initiatives. Our Audit Committee and our other Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes vulnerability scans related to vendors and a review of vendors' security certification reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, the Company may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The Audit Committee oversees the Company's enterprise risk management program, which includes periodic assessments of cybersecurity risk. As a part of these assessments, the Audit Committee reviews and discusses the risks identified by management and the Company's policies and practices in place to mitigate those cybersecurity-related risks. Management presents to the Board of Directors on our cybersecurity strategy, results of testing and training, and, as needed, to inform the Board of Directors and Audit Committee of any new or emerging threats or risks.

companyName: DYNEX CAPITAL INC

ticker: DX


text: Management's Oversight and Responsibilities Reporting to the CIO, Cybersecurity at Clean Harbors is managed by the Chief Information Security Officer who is a Certified Informational Systems Security Professional. The CISO leads the Clean Harbors' cybersecurity response program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework providing a collaborative, balanced risk based approach to securing and defending the Company.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Assessment and Strategy regularly evaluate cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our management on a periodic basis as deemed appropriate.

companyName: VIVIC CORP.

ticker: VIVC


text: To our knowledge, during the reporting period there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategies, results of operations, or financial condition. For additional information about risks related to cybersecurity, see our risk factors titled "Information technology system failures or interruptions may materially impact our operations and/or adversely affect our financial results" and "We could be materially adversely affected by a cybersecurity breach or failure of information security controls."

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. This program is a component of our ERM function. Our ERM function manages enterprise-wide risk and has established a governance structure in charge of continuous risk management. It has defined risk management processes related specifically to cybersecurity, which include targeted cyber risk reviews and annual cyber risk assessments over our IT and operations. We also have a Cyber and Privacy Risk Committee, led by our CISO, which provides strategic and actionable recommendations on cybersecurity topics, issues, and controls to our executive management team, and a Crisis Management Committee, led by our head of ERM, which manages significant cybersecurity events.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: Engagement of Third-party Support To further improve the effectiveness of our cybersecurity risk management program, we engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of cybersecurity controls.

companyName: Liquidia Corp

ticker: LQDA


text: Our cybersecurity incident response processes and policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our Security team and General Counsel work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes and policy include reporting to the board of directors for certain cybersecurity incidents.

companyName: Poseida Therapeutics, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Bridge Investment Group Holdings Inc.


text: While the Board has established a separate Risk and Sustainability Committee to oversee enterprise risk processes, the Board maintains oversight of Vistra's Information Security. Vistra engaged a third-party advisor to provide cybersecurity oversight and tabletop training to the full Board in 2023 to further our commitment to responsible oversight of cybersecurity risk management. At least quarterly, our CIO reports to the Board on our Information Security program, including cybersecurity risks and threats (including the emerging threat landscape), an assessment of our Information Security program, and the status of projects to strengthen our Information Security program. In furtherance of our commitment to responsible oversight of cybersecurity risk management, in 2023, the Board appointed a director who brings extensive cybersecurity expertise to the Board.

companyName: Vistra Corp.

ticker: VST


text: Upon the identification of a cybersecurity incident, the Incident Response Team (IRT) initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT communicates with the appropriate stakeholders, which may include the Audit Committee. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Advisor and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Advisor, and Dealer Manager, and our critical third-party vendors (including the transfer agent) and other partners.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity, having more than twenty years of professional IT experience in financial services. Prior to his current role, the CISO previously served as MetLife's Global Chief Technology Officer with accountability for the Company's global infrastructure, engineering, service operations, quality assurance, application maintenance, and production management functions; he also served variously as the chief technology officer, CISO, chief information officer and global head of telecommunications engineering at other financial institutions prior to joining MetLife in 2012.

companyName: METLIFE INC

ticker: MET


text: We continue to optimize our business continuity and disaster recovery plans aligned to the pervasive nature of cybersecurity incidents and threats. We also increased our cyber insurance which aligned to strengthen our internal systems. While the Bank has encountered, and will continue to encounter, cyber incidents in the normal course of business, to date, the Bank has not experienced a cybersecurity incident that has materially impacted our business strategy, financial condition, or results of operation. Despite our ongoing efforts to continually strengthen our cybersecurity program, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in safeguarding our systems and information. We face risks from certain cybersecurity threats that, if realized, could reasonably be expected to materially affect our business strategy, financial condition, or results of operation. See "Item 1A. Risk Factors – Operational Risks" in this 10-K for additional information.

companyName: Primis Financial Corp.

ticker: FRST


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Steven Kahn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Kahn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2015. Mr. Kahn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Kahn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.

companyName: Trinity Place Holdings Inc.

ticker: TPHS