text: The processes in place for managing cybersecurity threats, including threats associated with our use of third-party service providers, include identifying potential cybersecurity threats; defining the roles and responsibilities of our personnel pursuant to our Cybersecurity Incident Response Plan ("CIRP"); continuous testing and training of our employees on cybersecurity risks and security hygiene; communication and escalation protocols; and tools and technologies for incident detection and responses. We continuously assess risks and changes in the cybersecurity environment and adjust our processes and cybersecurity investments as appropriate.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our management team, including the leaders of our Global Information Technology and Information Security and Information Technology Compliance organizations, are responsible for assessing and managing our material risks from cybersecurity threats, including the primary responsibility for our overall cybersecurity risk management program, and supervision of both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has over 90 years of combined experience in cybersecurity, risk, and compliance, and includes members with multiple cybersecurity and compliance certifications such as Certified Information Systems Security Professional (CISSP) from ISC2, Certified Information Systems Manager (CISM) from ISACA, Certified Information Systems Auditor (CISA) from ISACA, Security+ and Network+ from the Computing Technology Industry Association (CompTIA), Certified Ethical Hacker (C|EH) from EC-Council, and other technology certifications.

companyName: Callaway Golf Co

ticker: CALY

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including our chief technology officer for Lofty and Trucker Path, our virtual chief information security officer, and our global IT manager.

companyName: Moatable, Inc.

ticker: MTBLY


text: Onex Corp. has established a dedicated cybersecurity team which maintains a comprehensive firmwide cybersecurity program to protect its systems, operations and the information stored within. Onex Corp.'s Audit, Nominating and Corporate Governance Committee receives at minimum, quarterly cybersecurity updates from the Managing Director – Enterprise Technology, who leads Onex Corp.'s program and who works closely with senior management to develop and advance Onex's cybersecurity strategy.

companyName: Onex Direct Lending BDC Fund


text: We maintain a cybersecurity program overseen by the Managing Director, Information Technology that uses a risk-based methodology to support the security, confidentiality, integrity and availability of our information. The security of our field infrastructure and corporate network is a priority for our business. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. Our cybersecurity program utilizes a combination of automated tools, manual processes and third-party assessments with the goal of identifying and assessing potential cybersecurity risks. These risks may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or business partners, violation of privacy or security laws and other litigation and legal risk and reputational risks.

companyName: Chord Energy Corp

ticker: CHRD


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Veritone, Inc.

ticker: VERI


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss,, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.

companyName: Wayfair Inc.

ticker: W


text: Our teams conduct vendor risk assessments of third-party suppliers that may receive access to personal data or connectivity to Wyndham's systems, for which such vendor risk assessments include information security control assessments and privacy impact assessments, regardless of the sensitivity of personal data potentially involved. The teams conduct similar internal assessments should any process potentially result in a significant change to the Company's data processing practices concerning sensitive data or have a potentially material impact on individuals' data and respective rights.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: The Company's Information Security Program (the "Program") is comprised of five pillars: the Information Security Policy, the Enterprise Information Security Risk Assessment, the Incident Response Plan, a formalized Security Awareness Campaign, and an enterprise monitoring and reporting program.

companyName: Investar Holding Corp

ticker: ISTR


text: Other Risk Factors See also "Item 1A – Risk Factors – Other Risks – Technology disruptions or cyberattacks could adversely impact the Company's operations."

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Our management team has taken additional steps to implement our cybersecurity risk management program. For example, we have implemented periodic management reviews of our controls related to provisioning of user access to certain third-party hosted applications that we use in connection with the business and risks posed by certain critical vendors; this includes reviewing System and Organizational Control audit reports of such vendors. We maintain insurance coverage intended to mitigate our financial exposure to certain cybersecurity threats, and we consult with external advisors regarding opportunities and enhancements to strengthen our cybersecurity processes and practices.

companyName: Seritage Growth Properties

ticker: SRG


text: Specifically, the Fund's relies on the enterprise risk management ("ERM") framework of BlackRock for the Fund's cybersecurity risk management and strategy. The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.

companyName: BlackRock Private Credit Fund


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance and financial risk areas.

companyName: Cerevel Therapeutics Holdings, Inc.


text: regular communications to all employees from management informing of the types of threats to be aware of and procedure to follow when a risk has been identified;

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: Our processes also address cybersecurity threat risks associated with our use of third party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.

companyName: JUNIPER NETWORKS INC


text: We provide regular training on cybersecurity threats to equip our personnel with effective tools to address them and to communicate our latest information security policies, processes and practices.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: A cross-functional team of senior leadership assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The team includes senior leaders in areas of importance to Company priorities, including the Company's Chief Privacy Officer, who is also our Vice President of Information Technology and the Chief Legal Officer. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: The Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") provide comprehensive briefings throughout the year to both the Cybersecurity subcommittee, which meets quarterly, and to the Board of Directors as well. The briefings include the current landscape of cybersecurity risks and emerging threats, relevant Company infrastructure and tools employed to address these risk and threats, status of ongoing initiatives, incident reports and learnings and compliance with regulatory requirements and industry standards.

companyName: CLEAN HARBORS INC

ticker: CLH


text: The CISO also provides quarterly updates to Uber's senior management regarding cybersecurity risks, as well as interim updates during regular meetings with Uber's engineering, product and internal audit leadership. The CISO and CPO also jointly chair Uber's Privacy and Cybersecurity Council, which provides a venue for cross-functional insight and input into the Cybersecurity Program and our privacy program as they relate to Uber's business operations.

companyName: Uber Technologies, Inc

ticker: UBER


text: In particular, the Senior Vice President, Engineering and Operations (SVP, E&O) reports directly to the President, Chief Executive Officer, and Chairman of the Board and holds the highest level of executive responsibility for assessing and managing all cybersecurity threats, incidents, and risks at the Company, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations.

companyName: Summit Midstream Corp

ticker: SMC


text: Our cybersecurity policies, standards, processes, and practices are integrated across our operational risk management programs and are based on recognized frameworks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in material adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: INSEEGO CORP.

ticker: INSG


text: Cybersecurity is part of the Bank's overall risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Internal Audit actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. External audit results are reviewed and reported on in our annual filing. Additionally, the Bank is a regulated entity and undergoes regulatory reviews to ensure it remains in compliance with all appropriate standards.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: In addition, the Company has a set of enterprise-wide policies, standards, and procedures concerning cybersecurity matters, which include an information security policy and program reviewed and approved by senior management and the Board of Directors. Additionally, technical standards and procedures related to incident response and use of Bank systems and devices are in place, as well as standards for critical security operational functions related to encryption, endpoint protection, vulnerability management, remote access, multifactor authentication, handling confidential information, use of internet, social media, email, and wireless devices. Policies and standards are subject to an internal review process and are approved by senior management.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Technical Safeguards As part of the Company's cybersecurity program, BancPlus regularly assess and deploy technical safeguards designed to protect the Company's information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience. In the event of a cybersecurity incident, the CISO will notify the Cybersecurity Committee.

companyName: BANCPLUS CORP


text: The CISO and CEO receive routine updates regarding current operations, threats, and industry trends. Findings from independent auditors as well as findings from internal audits and any penetration testing are presented to the CISO and CEO and corrective action is prioritized, where applicable.

companyName: Rubicon Technologies, Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our board of directors, business continuity plans, encryption of data, network security controls, systems monitoring, employee training, and cybersecurity insurance.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to its audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.

companyName: Nuvalent, Inc.

ticker: NUVL


text: The Special Activities Committee of our Board of Directors has primary oversight responsibility for cybersecurity risks related to our products and services. The full Board of Directors also receives periodic briefings from management regarding the Company's products and services cybersecurity risks. The Audit Committee also considers product and services cybersecurity risks in connection with its financial and compliance risk oversight role.

companyName: RTX Corp

ticker: RTX


text: We have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We are increasingly dependent on information technology, and potential cyber-attacks, security problems, or other disruptions present risks and could disrupt our operations, result in the loss of confidential information or damage our business relationships and reputation."

companyName: Highlands REIT, Inc.


text: We manage our risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by the Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. The Company seeks to prioritize the management of cybersecurity risk and the protection of confidential information and systems. Under the supervision of the Chief Executive Officer (" CEO ") and VP of Business Operations and Strategy, we work to identify all computing assets including hardware, software, and network infrastructure in order to conduct a risk assessment. We consider threats that may originate from both internal and external sources and maintain technical security controls internally. We are putting in place plans for our employees to receive mandatory recurring cybersecurity training and phishing exercises.

companyName: USA Rare Earth, Inc.

ticker: USAR


text: Risks from Cybersecurity Incidents To our knowledge, the Company has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations, or financial standing.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Sponsor periodically conducts risk assessments with vendors and other third parties that have access to the Firm's networks, customer data, and other sensitive information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Although often seen as a technical discipline, we view cybersecurity as a responsibility of corporate governance that encompasses risk management, reporting controls, testing, training, and executive accountability. Our motto is that every member of our organization is a part of our security team, a mantra that is embedded in our overall culture of service to our customers.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including deployment of threat monitoring and mitigation solutions, regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.

companyName: Molecular Templates, Inc.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and make recommendations to strengthen our risk management program.

companyName: TC Bancshares, Inc.

ticker: TCBC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Information Security Officer has over 20 years of expertise within the cybersecurity field, and manages an experienced team with expertise in relevant security practices such as penetration testing, security operations, and policy.

companyName: Blend Labs, Inc.

ticker: BLND


text: We depend on information technology and systems for various operations and for capturing accounting, technical and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk assessment process related to cybersecurity includes conducting vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. With the oversight of our Board of Directors, our management team is responsible for implementing a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners, and based on well-organized cybersecurity frameworks under a central control figure. Risks from cybersecurity threats did not materially impact our business strategy, operations, or financial condition for the twelve months ended April 30, 2024 and 2023 and are not reasonably likely to do so in the future, but no assurances can be made along those lines.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: The Chief Information Officer ("CIO"), who reports to the Chief Financial Officer, along with members of the corporate and business unit information technology teams, are generally responsible for developing and managing the Company's cybersecurity programs. Our CIO has over 20 years of experience in various information technology and information security roles, and our information security team is comprised of employees with broad knowledge of cybersecurity issues gained through experience and through training and certifications and includes our Director of Information Security, who has over 20 years of experience leading and managing cybersecurity programs. These individuals, along with other internal and external personnel as needed, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and applicable personnel are informed of known cybersecurity incidents to form the appropriate incident response team and respond accordingly.

companyName: IDEX CORP /DE/

ticker: IEX


text: The Board of Directors actively oversees the Company's management of cybersecurity risk. Primary responsibility for the Board's role in oversight of the Company's management of cybersecurity risk is delegated to the Risk Committee of the Board. The Risk Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures.

companyName: Enstar Group LTD


text: We are dedicated to continuous improvement in our cybersecurity program. We regularly monitor, evaluate, and aim to enhance our capabilities through investments in technology, infrastructure, and personnel. Our goal is to try to stay ahead of emerging threats and maintain the highest level of cybersecurity resilience.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Our Cybersecurity Incident Response Plan ("IRP") coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to detect, analyze, validate, investigate contain, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our processes also address cybersecurity threat risks associated with third-party service providers that may have access to our data or systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our third-party service providers.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: The Board of Directors provides oversight of the Company's cybersecurity program. The Audit Committee, which consists of non-employee independent directors, receives updates from the Chief Information Officer ("CIO") on cybersecurity performance and recent industry trends at least quarterly. In addition to regular cybersecurity briefings from the Audit Committee, the Board also receives periodic, but at least annual, updates from management regarding cybersecurity, including prompt notice of cybersecurity threats or incidents that could materially impact the Company. The Board is informed about risk profile status, adversary assessments, training initiatives, cybersecurity projects, emerging global policies and regulations, cybersecurity technologies and best practices, cyber readiness, third-party assessments, mitigation efforts, and response plans.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: From a management perspective, our Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") lead our cybersecurity efforts. Our CISO has extensive experience in cybersecurity, including creating and supporting cybersecurity programs for larger publicly-traded companies, obtaining cybersecurity certifications, participating in relevant cybersecurity leadership communities, and public speaking engagements on cybersecurity topics. He leads a cross functional cybersecurity team, which includes members of our legal department and internal audit function. As part of his job function, our CISO is charged to remain informed of the latest developments in cybersecurity, including the evolving threat landscape, as well as risk management improvement methods. This continual focus and understanding of the threat landscape, as well as risk treatment practices, is required to ensure that the CISO can effectively manage the Company's efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.

companyName: Enpro Inc.

ticker: NPO


text: Our manufacturing sites have formal business continuity plans that address site-specific priority responses, each determined through business impact analyses that integrate within our overall corporate crisis management response plan and enterprise risk management program. We conduct an annual incident response tabletop exercise as well as periodic exercises of formalized site business continuity plans. Lessons learned from the outcomes of these exercises are then assessed and used to inform and improve our formal cyber response procedures and business continuity plans.

companyName: ALBEMARLE CORP

ticker: ALB


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: We have not identified cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: OmniAb, Inc.

ticker: OABIW


text: We maintain policies and procedures for the safe storage, handling and secure disposal of customer information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could, ultimately, place sensitive customer or employee information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails targeting employees. We test employees monthly to determine their susceptibility to phishing test emails, and we require susceptible employees to take additional training and provide regular reports to management.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber risks and incidents. Our cybersecurity program is part of our internal risk management processes, and we continually improve our cybersecurity practices as new threats and vulnerabilities emerge.

companyName: AeroVironment Inc

ticker: AVAV


text: risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment;

companyName: Fold Holdings, Inc.

ticker: FLD


text: Our governance structure is designed to ensure effective oversight and management of cybersecurity risks: • The Board of Directors is actively engaged in overseeing cybersecurity matters, receiving regular briefings and ensuring alignment between cybersecurity strategy and overall business strategy. • A dedicated committee oversees cybersecurity governance, assessing policies, practices and risk mitigation strategies and ensuring alignment with industry best practices. • Our executive leadership team actively participates in the development and execution of cybersecurity strategy, reinforcing the importance of cybersecurity at the highest levels of the organization.

companyName: DNOW Inc.

ticker: DNOW


text: We depend on integrated information systems to conduct our business. In order to defend against cybersecurity threats, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. The frameworks used to design and assess our program include the National Institute of Standards and Technology Cybersecurity Framework and The Sarbanes-Oxley Act of 2002. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Our cybersecurity program is led by our Chief Technology Officer (" CTO "), who has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Our CTO oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: The Adviser also reviews the Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, monitors such service providers' use of information systems which have the potential to subject the Fund to information technology vulnerabilities and receives regular reports from the Fund's service providers regarding cybersecurity threats and incidents. T he CCO provides quarterly reports to the Board of Trustees regarding significant risks to the Fund, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Trustees regarding material cybersecurity risks as they arise.

companyName: Silver Point Specialty Lending Fund


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, there can be no guarantee that we will not be the subject of future successful threats or incidents. The Company has not been subject to any information security breach penalties or settlement payments.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: The Audit and Risk Committee of the Board, comprised fully of independent directors, is responsible for assisting the Board in oversight of risk, including cybersecurity risks. As part of that responsibility, the Audit and Risk Committee regularly reviews our enterprise risk assessment results, including the results of any cybersecurity risk assessments or audits, reports of investigations into any significant cybersecurity risks, and assessments of our insurance coverage for significant operational risks, including cybersecurity.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: The Board of Directors is responsible for the Company's risk management strategy and overseeing the Company's risk management program, of which cybersecurity is a critical element. The Chief Strategy and Technology Officer ("CSTO") and the Chief Information Security Officer ("CISO") are responsible for designing, implementing and administering the Company's cybersecurity risk management policies, processes and practices, business continuity planning and disaster recovery functions and activities. The CSTO and CISO meet on a quarterly basis with other members of Management as the Technology and Information Security Committee ("TIS Committee") to review the Company's cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Depending on the environment and system, the Company implements and maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to its Information Systems and Data, including, for example: an incident response plan, incident detection and response measures, monitoring and response services, network and system access controls, physical security measures, an employee cybersecurity training program, dedicated cybersecurity personnel, asset management and recovery processes, encryption of certain data, segregation of certain data, implementation of security standards/certifications, a vendor risk management program, penetration testing, dark web monitoring, monthly environment risk reviews, external threat intelligence reports, regular digital infrastructure scans, internally reported threats, data back-up measures, and cybersecurity insurance.

companyName: TerrAscend Corp.

ticker: TSNDF


text: In an effort to deter prevent and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: The Fund relies on management of the Investment Adviser to provide oversight and take responsibility for the administration of the cyber risk management program and for informing senior management and other relevant persons regarding the prevention, detection, mitigation, and remediation of cyber incidents. The Fund's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners.

companyName: Wellings Real Estate Income Fund


text: Our cybersecurity organization assesses, monitors, and manages cybersecurity risk through technical, physical, and administrative controls, including implementing cybersecurity policies, procedures, and strategies, with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while increasing our system resilience in an effort to minimize business impact should an incident occur. The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we maintain a Data Incident Response Program, which is designed to identify, assess, manage, and report significant data incidents, including those reasonably likely to affect our business strategy, results of operations, or financial condition. In the event of a cybersecurity incident, our cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm, with support from external technical and legal advisors and law enforcement, as appropriate. The Data Incident Response Program outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas, senior management, and the Company's Disclosure Committee or a sub-committee thereof as appropriate. The Disclosure Committee or a sub-committee thereof will consider the materiality of an incident elevated by the Data Incident Response Program, inform our Board and other key stakeholders as appropriate, and determine the Company's reporting obligation on a timely basis. Our organization tests and monitors these processes, including through table-top exercise testing with senior leaders.

companyName: Kenvue Inc.

ticker: KVUE


text: We maintain an incident response plan that guides us in identifying, evaluating, responding to, and recovering from cybersecurity incidents. The plan provides for the creation of a cross-functional, tailored incident response team, led by dedicated incident responders, that may include both Company personnel and third-party service providers, as appropriate. The incident response plan includes incident classification and escalation protocols, including a process for informing senior management and the Board, as appropriate, as well as processes to assess and comply with applicable legal obligations. We periodically test the effectiveness of the plan, and review and update it, as appropriate.

companyName: STARBUCKS CORP

ticker: SBUX


text: Our Head of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees, HCPs and patients to address cybersecurity risks. The Head of Information Technology cybersecurity function brings security credentials and expertise, with broad global cybersecurity and compliance experience in life science, healthcare, and federal government. In addition to our cybersecurity team, a managed security service provider provides us with additional coverage to monitor, detect and respond to threats and vulnerabilities.

companyName: Apellis Pharmaceuticals, Inc.

ticker: APLS


text: Our cybersecurity education and awareness program for employees and contractors covers a wide range of cyber topics including, but not limited to, policies and procedures, business/technology roles and responsibilities, threats and vulnerabilities, data privacy, confidentiality and asset protection. Our employees and contractors are required to complete mandatory initial onboarding and annual cybersecurity trainings, supplemented by other periodic cyber-related testing and training.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Investment Adviser's cybersecurity program and cybersecurity incidents impacting the Company, if any.

companyName: Brightwood Capital Corp I


text: Governance Structure Board Oversight. Our Board of Directors has delegated oversight of our Cyber Program to the Board Audit Committee. Despite that delegation, the full Board also remains informed, through quarterly presentations to the full Board by our Chief Financial Officer or their designee (or more frequently as necessary), followed by the opportunity for Q&A and discussion, on the status of the Cyber Program. The presentations cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages, and our employee-training programs. If further Board engagement on cybersecurity matters is required, management, through the CEO, CFO or CLO, communicate directly with the Audit Committee chair, who engages the Audit Committee as they deem appropriate.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: In the event of a cybersecurity incident impacting us, MC Advisors or MC Management, Monroe Capital has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Monroe Capital, including coordinating with the relevant employees of MC Advisors and MC Management. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Monroe Capital's Head of Information Technology, and the Computer Security Incident Response Team ("CSIRT"), as appropriate, escalation to the full ORC and/or an internal ad hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Monroe Capital, as well as to the Audit Committee (the "Audit Committee") of our Board of Directors (the "Board") and to our full Board, if appropriate.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ( CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating business segments. Both our CIO and the director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.

companyName: NL INDUSTRIES INC

ticker: NL


text: Board acknowledges the significance of robust cybersecurity management programs and actively participates in overseeing and reviewing our cybersecurity risk profile and exposures. Our Board receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents. Furthermore, in the event of any significant updates or adjustments to our cybersecurity related policies, our IT staff will present them to the Board for their review and approval.

companyName: AIRWA INC.

ticker: YYAI


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: Our Internal Audit department facilitates an annual enterprise risk assessment ("ERA") that is designed to gather information regarding key enterprise risks, emerging risks, and critical risk events that could impact our objectives and strategies. The Internal Audit department partners with our Information Security, Information Technology, and Privacy teams to gather information about risks related to cybersecurity threats. The ERA is presented to the Board and provides the foundation for the annual Internal Audit plan, management's monitoring and risk mitigation efforts, and ongoing Board-level oversight. On a quarterly basis, Gap Inc.'s Chief Audit Executive updates the Audit and Finance Committee on the Internal Audit plan. The Audit and Finance Committee also reviews updates to the Company's enterprise risk profile, including identified cybersecurity risks, throughout the year. Additionally, key third-party dependencies are monitored as part of our overall business continuity planning, with the Audit and Finance Committee receiving periodic updates.

companyName: GAP INC

ticker: GAP


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical IT systems, information and Intellectual Property (IP). Cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Impact of Cybersecurity Risk To date, we have not been subject to any cybersecurity incidents that, individually or in the aggregate, have had a material impact to our operations or financial condition, although we recognize that cyberattacks impacting our networks or systems may have a material adverse effect on our operations in the future, as discussed in our Part I, Item 1A—Risk Factors. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. However, we do not have reason to believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our business, reputation, operations, or revenue over the long term.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of this program are based on recognized best practices and standards for cybersecurity and information technology, including those set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Among the key elements of our cybersecurity risk management program are the following: • Security Awareness and Training—We use an IT security awareness program consisting of training on the fundamentals of information security protection. These training courses are required to be completed annually by all employees. • Annual Risk Assessment—An annual risk assessment is conducted by a third party, which is designed to assess the effectiveness of the Company's security controls and to identify key risks. • Network Protection—Network protection, detection, and monitoring technologies have been deployed on all external and internal network connections, in order to segment different sections of the business from each other, which strengthens key protection capabilities. • Identity and Access Management—We have implemented user authentication controls on the Company's systems, devices, data and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to systems and networks. • Penetration Testing—We have partnered with a third-party penetration testing company to help identify new vulnerabilities and continuously improve the security posture of the Company through annual testing. • Endpoint Detection and Response ("EDR")—EDR is an integrated, layered approach to endpoint protection that uses continuous monitoring and data analytics. We have partnered with a third-party security operations center, to provide critical support in monitoring, identifying and assessing cyber threats such as malware, ransomware, breaches, and denial of service attacks. • Security Incident Management—In the event of a cybersecurity incident, we have established an incident response plan, which outlines clear protocols for incident detection, containment, investigation, and resolution, aiming to minimize the impact on our operations, customers, and stakeholders.

companyName: AZZ INC

ticker: AZZ


text: The Company's management team and board of directors jointly oversee the Company's cybersecurity. The third party consultants provide monthly online security reports as well as any web based security updates and possible threats to be aware of.

companyName: My City Builders, Inc.

ticker: MYCB


text: The Advisor's Information Security team has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The Board, in coordination with the Audit Committee and the Risk Management Committee, which is comprised of senior management of the Company, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board, Audit Committee and Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board, Audit Committee and Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets materiality reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the CISO holds security risk meetings with LKQ's business segment leadership to highlight the security risk environment, policies, controls, and remedial actions planned to address risks or vulnerabilities. On an annual basis, the Board and the Company's Chief Information Officer ("CIO") and CISO discuss the Company's approach to cybersecurity risk management.

companyName: LKQ CORP

ticker: LKQ


text: Risks from Cybersecurity Incidents As of December 31, 2024, and for the past five years, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. Cybersecurity Governance We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams, such as our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise Incident Response Plan ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our CISO and CIO are also members of our information and security governance group, led by our CIO, which is comprised of executive and senior leadership from a variety of functions, including information security, corporate security, legal, finance, human resources, internal audit and compliance, as well as members of Teva's global situation room ("GSR"). Additionally, our CISO, CIO and other members of our information security office may, from time to time, consult and coordinate with other Teva departments and members of management to manage cybersecurity risks, promote cybersecurity awareness and implement cybersecurity incident responses.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: The Company assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company's IT team conducts a series of sessions to discuss and evaluate risks and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based upon this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company's Chief Executive Officer, and approved by the Company's Data Protection Team ("DPT"). The DPT consists of the Company's Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our Chief Legal Officer who serves as our Chief Compliance Officer), with oversight from our audit committee of the board of directors (Audit Committee), our Head of Information Technology (Head of IT) has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Legal Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.

companyName: Absci Corp

ticker: ABSI


text: Our cybersecurity program is led by our director of information technology (IT), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our director of IT has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our director of IT reports to our vice president in charge of coordinating operational activities within our business segments. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Board & Management Cybersecurity Risk Oversight We incorporate all of the Company's cybersecurity processes and assessments into our overall enterprise risk program. This allows us to develop a complete consolidated view of our risk factors across our cybersecurity, information technology, and business functions. As part of the Company's enterprise risk program, the Information Risk Committee ("IRC") is responsible for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRC is chaired by the Chief Information Security Officer ("CISO") and the Senior Vice President – Legal ("SVP – Legal)" responsible for Privacy and Compliance Issues, with the Chief Financial Officer, Chief Information and Distribution Officer, and the General Counsel and Chief Compliance Officer as members. The IRC meets regularly to review operations of the Company's cybersecurity programs and processes, and to discuss emerging legal, technical, or other risks. The Audit Committee of the Board is the Board-level committee with oversight of privacy and security matters. The IRC updates the Audit Committee quarterly to provide risk updates and general education on privacy and information risk trends. The Board is made aware promptly of any cybersecurity incidents that are deemed critical or that could potentially have an impact on the business. The Board also receives periodic privacy and security awareness training from third-party subject matter experts.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for an initial business combination. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing our risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. In fiscal year 2023, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy and results of operations.

companyName: OCA Acquisition Corp.


text: Our cybersecurity program is overseen by the Company's Chief Information Security Officer ("CISO") and is designed to protect and preserve the confidentiality, integrity and availability of our information technology assets. Risks and controls are monitored by the CISO and CIO and their evaluation of our overall program drives the nature and scope of our cybersecurity investments. Our CISO reports directly to the CIO and has 20 years of IT experience including leadership roles at various companies with enterprise responsibility for IT audit, IT infrastructure, and cybersecurity. The CISO reports to the Audit Committee on the effectiveness of the Company's cybersecurity program controls aligned to the NIST CSF framework. We periodically engage external subject matter experts who provide independent qualitative and quantitative assessments of the cybersecurity program maturity and response readiness. We also use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. In addition, the Company leverages a monthly cybersecurity awareness training program for all employees that is further reinforced through frequent phishing simulations.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Risk Management and Strategy recognize the increasing significance that cybersecurity has to our operations and the success of our business, as well as the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. We process and maintain sensitive data on our Clients and members, including in the form of PHI and PII. In addition, we maintain intellectual property for our solutions and personal information of our employees. Because of the data we manage, we are subject to various cybersecurity threats that, if they materialized, could adversely affect our business, employees, Clients, and members through impacts to the confidentiality, integrity, and/or availability of our systems. We maintain a cybersecurity program and controls as part of our enterprise risk management program in an effort to reduce the risk of exposure of our information and systems.

companyName: MediXall Group, Inc.

ticker: MDXL


text: The CST works closely with the sourcing and vendor management team when contracting for third-party information technology services. Our information technology architecture review board, which includes cybersecurity leadership, reviews all potential vendors. We have comprehensive cybersecurity assessment processes and procedures in place, including security risk questionnaires, standard documentation requests, and utilization of a third-party risk evaluation tool to provide insight on potential third-party vendors. We utilize private connections (including private VPN) and extensive use of virtual desktops to secure access to our data and systems. Our legal team ensures that specific protections are included in contracts, including confidentiality language, nondisclosure obligations and security provisions.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: At QHSLab, Inc., we prioritize the security and privacy of all data, with a special emphasis on the personal health, financial, and insurance information entrusted to us by our medical practice clients and their patient electronic personal health information (ePHI). Recognizing the unique vulnerabilities of the digital medicine sector, we have developed an internal cybersecurity risk management framework that incorporates industry-leading practices and technologies to safeguard against cyber threats.

companyName: QHSLab, Inc.

ticker: USAQ


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage external experts, including managed security service provider (MSSP) and consultants, to evaluate our cyber governance and monitor our risks. These partnerships enable us to leverage their specialized knowledge to help ensure that our cybersecurity strategies and processes reflect industry best practices.

companyName: V2X, Inc.

ticker: VVX


text: We regularly engage third-party assessors, auditors, and solutions to test and evaluate our controls for managing cybersecurity threats. These engagements include penetration testing, vulnerability assessments, internal and external audits, security framework maturity assessments for continued focus and improvement, and social engineering tests of the effectiveness of our employee training to monitor our security posture. We leverage a managed security service provider to monitor users, application, infrastructure, and network activity on a 24/7/365 basis to detect and alert the cyber security operation team of cyber threats and potential cybersecurity events of concern.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Although our cybersecurity risk management program, as described above, is designed to help prevent, detect, respond to, remediate, and mitigate the impact of cybersecurity incidents, there is no guarantee that a future cybersecurity incident would not materially adversely affect the Company's business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see the headings "Our business is dependent on the efficient and uninterrupted operation of computer network systems and data centers, including third party systems" and "A data security breach could expose us to liability and protracted and costly litigation, regulatory penalties, and could adversely affect our reputation and operating revenues" included as part of our risk factor disclosures in "Part I, Item 1A, Risk Factors," of this Annual Report on Form 10-K.

companyName: GREEN DOT CORP

ticker: GDOT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use several means to assess cyber risks related to our third-party service providers, including maintaining a vendor code of conduct and vendor questionnaires due diligence in connection with onboarding new vendors and due diligence with key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.

companyName: NEXTNAV INC.

ticker: NN


text: This includes protecting against known and evolving threats to the security of the Company's systems and information, and against unauthorized access, compromise, or loss of data. The Cybersecurity System is managed centrally, so the same security controls, policies and procedures are implemented across the organization. The Company maintains cybersecurity policies including an Acceptable Use Policy that all system users sign to acknowledge that they understand their security responsibilities. All system users receive security awareness key element of the Company's Cybersecurity System is to mature the program to align with the Center for Internet Security (CIS) Critical Security Controls security framework. The CIS controls are designed based on real-world data about cyber-attacks, to ensure that the measures are effective against current threats. The framework provides a prioritized set of actions, which enables the Company to focus its efforts on the most effective defensive measures first. This prioritization helps in optimizing the use of resources for maximum impact on security. This strategy provides a structured and effective approach to cybersecurity, helping the Company to protect its assets, comply with regulations, manage risks, and improve its overall security posture.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: We believe we have implemented processes that are designed to effectively manage risks from cybersecurity threats. Through our Service Provider, we have established an Incident Response Plan (the "IRP"). The IRP lays out our guidelines for responding to and handling cyber incidents. The IRP helps to ensure a quick and organized response in the event of a cyber incident and helps ensure all necessary members of management are informed so action can be taken as soon as possible. Under the IRP, once a cyber incident is identified, a response team will review the details of the cyber incident, inform management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.

companyName: Edible Garden AG Inc

ticker: EDBL


text: Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: regulatory-based risk assessments for the Company's systems and applications (where formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident;

companyName: Electromed, Inc.

ticker: ELMD


text: Our periodic assessment and testing of policies, standards, processes and practices that are designed to address cybersecurity threats and incidents include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.

companyName: GoPro, Inc.

ticker: GPRO


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology and Facilities Director (the "ITFD"). Our ITFD is a third-party consultant, from whom we have a dedicated resource who specializes in the industry, has over 25 years of experience addressing cybersecurity risks. Our ITFD is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CFO oversees the ITFD and briefs our Board on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy for assessing and managing material risks from cybersecurity threats. Our current CISO has over 25 years of cybersecurity experience across a wide array of industries, most recently serving in leadership positions at two different public companies and previous roles of increasing responsibility at multinational technology companies. Our CISO reports directly to our CIO, who is a member of our Executive Committee and reports to our Chief Executive Officer.

companyName: Moderna, Inc.

ticker: MRNA


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For more information about the risks we face from cybersecurity incidents, please refer those discussed risk factors starting with "We may incur substantial costs in our efforts to comply with evolving global data protection " and "Our internal computer systems, or those of our collaborators " in the section entitled "Risk Factors" included under Part I, Item 1A of this Report.

companyName: PLIANT THERAPEUTICS, INC.

ticker: PLRX


text: Impact of Risks from Cybersecurity Threats We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition.

companyName: Paycom Software, Inc.

ticker: PAYC


text: We continuously review and seek to enhance our program as risks evolve and compliance requirements change. We use our internal security team and engage third-party cybersecurity companies. Together we conduct periodical assessments and ongoing enhancements to our cybersecurity posture and identify and remediate risks from cyber threats. The assessment includes reviewing third-party service providers periodically and before new engagements.

companyName: Titan Machinery Inc.

ticker: TITN


text: Our information security program is designed to detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our systems from cybersecurity threats, we use various security tools that help prevent, escalate, investigate, and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: MAGELLAN COPPER & GOLD Corp

ticker: MAGE


text: Trulieve's cybersecurity program is managed by our Chief Technology Officer ("CTO") and our Senior Director of Information Security, whose team ("Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our CTO has over 20 years of experience with large information technology footprints, including cybersecurity. His in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Information Security Governance Committee ("IT Committee") and Audit Committee of our Board of Directors oversee management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: The management team is responsible for establishing and monitoring the integrity and effectiveness of our controls and other procedures, which are designed to ensure that all information required to be disclosed is recorded, processed, summarized and reported accurately and on a timely basis, and all such information is accumulated and communicated to management and the Board, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the Board's oversight include processes related to managing material risks from cybersecurity are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including in our business strategy, results of operations or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, loss of sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. See "Part I, Item 1A. Risk Factors" for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.

companyName: Hi-Great Group Holding Co

ticker: HIGR


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, encryption of certain data, segregation of certain data, network security controls, physical security controls, asset management, employee training, penetration testing, and cybersecurity insurance. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel.

companyName: IN8BIO, INC.

ticker: INAB


text: To date, we have not identified any cybersecurity threats or incidents which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition; however, there is no guarantee that we will not be the subject of future successful cybersecurity threats or incidents that may materially and adversely affect the Company, including its business strategy, financial condition, results of operations or prospects. Additional information on cybersecurity-related risks is discussed under the heading "Risks Associated with our Information Technology Systems" under Item 1A, which should be read in conjunction with Item 1C.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, legal, compliance, IT, and business leaders meet regularly to develop strategies for preserving the confidentiality, integrity, and availability of Company, employee, and third-party information provided to us; identifying, preventing, and mitigating cybersecurity threats; and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding legal and regulatory compliance, public disclosure, and reporting of such incidents can be made by management and presented to the Audit Committee and the Board, as necessary, in a timely manner.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: The Company, through its Enterprise Risk Management, Enterprise Technology, and Internal Audit departments, actively maintains and monitors various systems, controls and surveillance measures that are intended to mitigate cybersecurity risks including:

companyName: National Bank Holdings Corp

ticker: NBHC


text: We have not experienced any material cybersecurity incidents to date that have materially affected, or that are reasonably likely to materially affect our business, strategy, results of operations or financial condition, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including to our results of operations and financial condition. We rely extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: PPG's cybersecurity program is designed to protect and preserve the confidentiality, integrity and availability of our networks and systems as well as information that we own or is in our care through a risk-based approach. The Company's program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures and Report up to the Executive Incident Response Committee, as needed.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Vendor Risk Management The Company evaluates the risk profile of its third-party service providers and may include cybersecurity enhancement or compliance requirements in its service agreements, as needed. The information security team periodically reviews key vendors and counterparties' cybersecurity practices and may conduct audits or assessments at its discretion.

companyName: IMAX CORP

ticker: IMAX


text: The Corporation recognizes that our overall security culture contributes to the effectiveness of our ISP. The Corporation maintains an enterprise risk management program that identifies, prioritizes and provides a formal structure for the internal and external risks that impact the organization. The Board of Directors sets the tone and direction for the Corporation's use of IT and has identified the Audit Committee as having primary responsibility for oversight of the Corporation's risk exposures and risk assessments and policies, including risks related to cybersecurity. The Board of Directors and Audit Committee approve and periodically review and re-approve the ISP and other IT related policies. While the Board of Directors may delegate the design, implementation, and monitoring of certain IT activities to the CIO or designee, the full Board of Directors remains responsible for overseeing IT strategies and policies, including cybersecurity. To help carry out their responsibilities, Directors, management, and all employees are periodically trained to understand IT activities and risks, including cybersecurity risks. Management, via the Systems and IT Steering Committee and ISO, or combination, provides a status report to the Board of Directors at least annually, with more frequent communications as necessary. The report describes the overall status of the ISP and material matters related to the program, including security breaches, cybersecurity assessments, cybersecurity awareness training for employees and the Board of Directors and results of incident response testing.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: The NGC receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We are not aware of any cybersecurity incidents that could have a material impact on our business strategy, results of operations, or financial condition.

companyName: Progressive Care Inc.


text: Our cybersecurity department, comprised of various levels of management and led by our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The cybersecurity and information technology governance departments have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants and suppliers. In addition, our cybersecurity and information technology governance departments provide reporting to our Risk Council that is led by our Senior Vice President of Internal Audit and is comprised of certain members of management from diverse functional areas and business units, including risk, finance, legal, accounting, tax, operations, cybersecurity, privacy, human resources, and environmental sustainability. The Risk Council is responsible for identifying, assessing, prioritizing, and monitoring critical risks of the Company. The Risk Council meets quarterly and assesses risks based on potential impact to the Company, both in terms of inherent risk, or the risk exposure without consideration for how the Company manages the risk, as well as residual risk, or the risk exposure remaining after consideration of the Company's existing risk mitigation efforts. The Risk Council periodically reports to the board of directors and the Audit Committee regarding the Company's risk management processes and procedures.

companyName: Hyatt Hotels Corp

ticker: H


text: The CISO monitors the Company's cybersecurity posture through the Security Incident Response Team, which consists of key individuals in the legal, human resources, compliance, privacy, risk and information security departments across Rithm Capital and its operating companies. Any escalations will then be raised by the CISO and CIO to Company management who will work with the CISO and CIO to determine the appropriate remediation effort.

companyName: Rithm Capital Corp.

ticker: RITM


text: Management plays an important role in assessing and managing Getty Images' material risks from cybersecurity threats. The CTO is responsible for oversight of the design and implementation of the security program and strategy. Getty Images' current CTO has served in various roles in technology for over 25 years, and has had had oversight of information technology and information security for both Getty Images (6+ years) and other organizations.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Our Chairman of the Board, Mr. M. Kevin McEvoy, has earned a National Association of Corporate Directors ("NACD") Cybersecurity Oversight certification and a Computer Early Response Team ("CERT") Cybersecurity Oversight Certification from Software Engineering Institute, and our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that we believe equip them to oversee cybersecurity risks effectively.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors—Risks related to our business—Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."

companyName: CARGO Therapeutics, Inc.


text: Management regularly evaluates and enhances its cybersecurity measures to mitigate cybersecurity risks. The Company's CISO is responsible for all aspects of the Cybersecurity Program, including managing cybersecurity functions, ensuring that cybersecurity staff are adequately skilled and trained in the activities required for their respective job functions, and overseeing corporate cybersecurity initiatives. Under the direction of the CISO, the Cybersecurity Department regularly monitors for enterprise-wide compliance with Cybersecurity Program procedures and regulatory requirements. Our CISO, in collaboration with our Chief Information Officer ("CIO"), Chief Risk Officer ("CRO"), and senior management, drives awareness, ownership and alignment of cybersecurity protocol for effective cybersecurity risk management across all lines of business and corporate functions. The CISO and CIO are responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes to effectively prevent, detect, mitigate and remediate cybersecurity threats. Our CISO has expertise in cybersecurity, information security risk management, identity and access management, security architecture, application security, vulnerability management, threat intelligence, security operations and incident management and response through prior roles leading information security functions at financial institutions. The CISO holds multiple professional certifications, including Certified Chief Information Security Officer through the International Council of Electronic Commerce Consultants, also known as the EC-Council.

companyName: Bancorp, Inc.

ticker: TBBK


text: See "Risk Factors - Security breaches, cyber-attacks and other interruptions to our or our third-party service providers' infrastructure have disrupted and may continue to disrupt our internal operations and we may be exposed to claims and liability, lose customers, suffer harm to our reputation, lose business-critical compliance certifications and incur additional costs." for more information on our cybersecurity risks.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: We annually undergo a Payment Card Industry (PCI) compliance certification process and obtain an attestation through a Qualified Security Assessor (QSA). We have an established bug bounty program and conduct penetration testing as needed to identify vulnerabilities for remediation. With respect to third party service providers, we obligate vendors to adhere to privacy and cybersecurity measures, perform risk assessments of vendors including their ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks, as we provide content licensing to customers in more than 150 countries and license content from contributors located in over 100 countries. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business including brand reputation, customer sales, legal impacts, and financial costs. While we have experienced cybersecurity incidents, to date, we have not experienced any material cybersecurity incidents.

companyName: Shutterstock, Inc.

ticker: SSTK


text: The Company has developed an information security program to assess, identify, and manage material risks from cybersecurity threats, which is included in our overall risk management system and processes through a layered governance structure. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. An internal cyber risk assessment is conducted annually. The risk assessment is used by management to consider implementing and augmenting cybersecurity controls where feasible and appropriate with the intent of mitigating cybersecurity risk exposure. The Company employs a broad array of cybersecurity tools and controls to manage exposure to cybersecurity risks.

companyName: DILLARD'S, INC.

ticker: DDS


text: Cyber security risk management at Noble, along with all enterprise risks, is part of the Company's Enterprise Risk Management Program and risks from cyber security threats are assessed, identified, and managed by our Information Security Team. The Information Security Team reports to the Chief Information Officer ("CIO"). The Information Security Team is composed of information security managers and security analysts.

companyName: Noble Corp plc

ticker: NE


text: Program Adjustments The ISO monitors, evaluates and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements and changes to customer information systems.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: The CISO, Senior Vice President – Enterprise Information Security, and Vice President – Cyber Risk Governance regularly inform the Chief Executive Officer, the Chief Operating Officer, the Chief Risk Officer, the Chief Information Officer, the Chief Technology Officer, the Chief Compliance Officer, and the Chief Audit Officer of all concerns related to cybersecurity risks and incidents, including the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. This aims to ensure that senior management is kept up to date on the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Company's Board of Directors, ensuring that they have comprehensive information and can provide oversight with respect to critical cybersecurity issues.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Executive leadership Our Chief Technology Officer and the information security team periodically present information about the Company's information security program, including program goals and actions, progress against key initiatives and key risks, to our executive leadership team. As described above, significant risks related to cybersecurity are escalated to the Audit Committee and/or the full Board as appropriate.

companyName: Outset Medical, Inc.

ticker: OM


text: Our Chief Information Officer joined the Company over 25 years ago and has expertise across a wide array of information technology and systems, with experience leading a large array of different functions within the global information technology organization. He has led our information technology Operational Performance and Reliability Committee for the last nine years, which reviews and provides continuous improvement processes and technology across infrastructure, information security, architecture, application and end user performance. He has application development leadership experience across all functions, including the policies and controls that govern both application development and implementation of packaged software. He has a certification from Stanford University for Cybersecurity and Executive Strategy.

companyName: COLGATE PALMOLIVE CO

ticker: CL