text: Board Oversight—Our Board of Directors (the "Board"), as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee. Our Board has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CDTO and the CISO, on various cybersecurity matters, including the security of our information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The Board's Audit and Compliance Committee receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the Audit and Compliance Committee, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit and Compliance Committee.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Operational and Compliance Risk Committee of the Board. The Operational and Compliance Risk Committee of our Board of Directors oversees management's design, implementation, and enforcement of our cybersecurity risk management program.

companyName: SLM Corp

ticker: SLM

secItem: Item 1C


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 6 years. He has over 39 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.

companyName: AEye, Inc.

ticker: LIDR


text: Third-Party Risk we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the system and organization controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Birdie Win Corp

ticker: BRWC


text: The Board and the Risk Policy and Capital Committee generally engage in discussions throughout the year with management on cybersecurity risk matters. The Chief Security Officer and other members of the management team provide reports to the Board and the Risk Policy and Capital Committee on cybersecurity risk matters on a regular basis, including updates on our cybersecurity risk management program, as well as external cybersecurity developments, threats and risks. Management also discusses cybersecurity developments with the Chair of the Risk Policy and Capital Committee and other Board members between Board and committee meetings, as appropriate. The company has procedures to escalate information regarding certain cybersecurity incidents to the Board Chair. At least annually, the Board reviews and approves the company's Cybersecurity Risk Policy and Operational Risk Policy.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We also engage third-party providers to bolster our cybersecurity risk management and strategy. Some provide ongoing assistance, including threat monitoring, mitigation strategies, and updates on emerging trends. Others provide targeted expertise, such as security assessments and forensic analysis.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: In addition, our cybersecurity incident response processes are designed to escalate material cybersecurity incidents to members of management as part of the enterprise level Crisis Management Framework. The CISO, CIO, CRCO and senior operating unit leaders are part of the crisis management team in an effort to promote the prompt mitigation of cybersecurity incidents and facilitate the notification of appropriate stakeholders.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Our Chief Information Officer is responsible for the oversight of our cybersecurity risks. We have implemented a security incident response plan and use this incident response framework as part of the process we employ to keep the Audit Committee and our executive management informed about cybersecurity risks and to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The plan is a set of procedures and tasks that our incident response team, under the direction of the Chief Information Officer, executes with the goal of ensuring timely identification and appropriate resolution of cybersecurity incidents. In addition, we validate compliance with our internal data security controls through the use of security monitoring tools.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: We, with assistance from our contracted third-party cybersecurity advisors, identify our cybersecurity threat risks by comparing our processes to standards set by the National Institute of Standards and Technology, or NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is a potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: We understand the importance of informed personnel, so we conduct mandatory, regular training on cybersecurity threats. This training aims to equip our staff with the necessary tools to confront these threats effectively and disseminate updates on WidePoint's evolving information security policies, standards, processes, and practices.

companyName: WIDEPOINT CORP

ticker: WYY


text: Our Chief Information Officer and Director of IT Security report directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate under the circumstances.

companyName: SelectQuote, Inc.

ticker: SLQT


text: As part of the above processes, we regularly engage with third-party cybersecurity vendors to provide a range of services in furtherance of our cybersecurity program, including monitoring our cybersecurity systems and processes to help identify areas for continued focus, improvement and compliance. In addition, we also have a process to assess and review the cybersecurity practices of third-party vendors and service providers, including through the use of contractual security requirements and performing diligence, as appropriate.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: To date, w e have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. As mentioned above, the changes in our business and operations may impact our cybersecurity program in the future. In addition, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of General Counsel, Head of HR & Chief Technical Officer (CTO) meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our Chief Executive Officer, Chief Operating Officer, Chief Commercial Officer & Chief Financial Officer.

companyName: Beyond Air, Inc.

ticker: XAIR


text: If any incidents occur, we have a comprehensive Incident Response Plan in place. The Plan includes materiality qualifiers based on the size and scope of the incident. Furthermore, there is an escalation matrix that identifies who is directly involved with managing the incident based on the severity. An Incident Report is compiled for all incidents, regardless of materiality. Management reviews the incident reports and ensures all incidents are mitigated and remediated effectively. These reports are shared with the CIO, CFO, and Audit Committee so they can effectively manage resources to reduce risk and prevent future incidents.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: The ciso is informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity program described above, including through reports prepared by our internal cybersecurity team and the operation of our incident response plan. The ciso meets regularly with leaders of our various information technology management teams and with the Risk Management Committee (a management-level committee, which is co-managed by our cfo and chief legal officer), to review and discuss our cybersecurity and other information technology risks and opportunities.

companyName: STARBUCKS CORP

ticker: SBUX


text: The Company also appointed a certified CISO who has significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the ERC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, review overall cybersecurity strategies and policies and to report on material cybersecurity risks.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Management and Strategy have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks. However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: Hypha Labs, Inc.

ticker: FUNI


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of the board of directors, or the audit committee, oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: We rely on the information systems of third-party vendors, including our cloud vendors, for various functions of our business, including manufacturing, sourcing, distribution, sales and marketing. We engage a third-party risk management software to oversee and identify the risks from cybersecurity threats associated with relevant vendors, based on the services such vendors provide and the information to which they have access. In addition, as part of our new vendor onboarding procedures, we review proposed new vendors' cybersecurity and data protection practices and collaborate with such vendors to align their cybersecurity platforms with our expectations.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees our day-to-day security operations, and our Chief Information Officer ("CIO") oversees our secure development activities.

companyName: CORVEL CORP

ticker: CRVL


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner.

companyName: UNITED SECURITY BANCSHARES

ticker: UBFO


text: Currently, our board of directors oversees our risk management program, including with respect to material cybersecurity threats and associated risk exposures. The ACT reports to the board of directors semiannually on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cybersecurity threats and the status of initiatives intended to bolster our cyber security systems and the cyber readiness of our personnel.

companyName: QXO, Inc.

ticker: QXO


text: Our CISO has announced his intention to retire at the end of December 2024. The Company expects to appoint a successor in the near future.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • compare our processes to benchmark standards, such as those set by the National Institute of Standards and Technology (NIST); • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • conduct annual customer data handling and use requirements training for employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • through policy, practice and contract, as applicable, require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • leverage the NIST incident handling framework to help us govern, identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Cybersecurity risks are identified as part of our Enterprise Risk Management Program and regular cybersecurity assessment and planning. We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage cybersecurity risks. We engage with industry groups for benchmarking and awareness of cybersecurity best practices. We monitor internal and external cybersecurity developments that may affect our systems and our supply chain partners' systems, and have procedures to assess those issues for potential cybersecurity impact or risk.

companyName: Qorvo, Inc.

ticker: QRVO


text: Core security operational and engineering functions, along with third-party supplier security assessments, are managed by our internal security employees. Third-party consultants are engaged to perform assessments of our cybersecurity program, and for security incident response where impact and materiality reach a critical threshold.

companyName: VERINT SYSTEMS INC


text: The audit committee receives periodic reports from our Senior Director of IT concerning significant cybersecurity threats, related risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries and presentations related to cybersecurity threats, risks and mitigation.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Senior management at Comerica governs risk management and is informed about, and monitors the prevention, detection, mitigation and mediation of cybersecurity incidents, in part through working review committees on which our Chief Information Security Officer and/or Chief Information Officer serve. Each review committee receives risk management reports appropriate to its scope of review, covering matters such as assessment results, risk ratings and critical issues. They report significant matters to enterprise-wide risk committees overseeing the broad scope of risk management for the enterprise as appropriate. Through these and other efforts, senior management makes decisions and sets priorities in allocating resources to address risk management issues.

companyName: COMERICA INC

ticker: CMA


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.

companyName: VOC Energy Trust

ticker: VOC


text: Ball's Chief Information Security Director (CISD) reports to the Senior Vice President and Chief Information Officer (CIO) and leads the company's cybersecurity team. The CISD is responsible for overseeing cybersecurity, including assessing and managing cybersecurity risk, and together with the CIO, providing comprehensive briefings to the executive leadership team with respect to the cybersecurity program and emerging or potential cybersecurity risks. The cybersecurity team has extensive experience selecting, deploying, and operating cybersecurity technologies, strategies and processes, and couples this knowledge with the use of external experts employed by Ball to protect the company from cyber threats.

companyName: BALL Corp

ticker: BALL


text: We are committed to the ongoing identification and management of cybersecurity risks as part of our business strategy, financial planning, and capital allocation. We strive to incorporate cybersecurity considerations into all aspects of our operations. As the cybersecurity landscape evolves, so does our strategy to identify and mitigate these risks. We continuously work towards enhancing our processes to ensure an effective cybersecurity posture. Board of Directors and Management Governance.

companyName: UFP INDUSTRIES INC


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Information and Cyber Security," which should be read in conjunction with the information above. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Audit Committee receives reports regarding such risks from management, including our Chief Technology Officer, and reports to the Board at least quarterly. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents. Our Chief Technology Officer, who has extensive cybersecurity knowledge and skills gained from over ten years working in the technology industry, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Aterian, working closely with our General Counsel who has a certification in Data Security and Privacy Policy from Cornell University. Both our Chief Technology Officer and General Counsel report directly to one of our co-CEOs.

companyName: Aterian, Inc.

ticker: ATER


text: Since January 2023, our cybersecurity program has been overseen by our Executive Vice President and General Counsel. Our Executive Vice President and General Counsel has significant risk management, governance and litigation experience. We believe these skills are needed in leadership of our cybersecurity program to help ensure that risk management, legal, disclosure and governance perspectives are considered in the design of our cybersecurity program and in evaluating and responding to potential cyber incidents. CenterPoint Energy currently engages a third-party consultant, who reports directly to the Executive Vice President and General Counsel, to provide Chief Information Security Officer (CISO) advisory services. This consultant has 15 years of experience serving in cybersecurity leadership positions, including as a CISO at a large U.S.-based power, utility, and gas company and also at a large multi-national energy products and services company. We also have management-level committees and an experienced CSOC team that support our processes to assess and manage cybersecurity risk as follows: • The Data Privacy Office, led by our Senior Vice President, Deputy General Counsel, Chief Ethics and Compliance Officer, and Data Privacy Officer, addresses the collection, storage, usage, disclosure and destruction of data for specific business purposes and addresses existing and emerging laws, regulations, trends, expectations and best practices with regards to maintaining a mature data privacy program. • The Risk Oversight Committee, which is supported by our Enterprise Risk Management function and chaired by our Executive Vice President and General Counsel, is comprised of senior executives from across CenterPoint Energy, monitors and oversees risks facing CenterPoint Energy, as well as provides risk assessments and control oversight for certain business activities, including overseeing CenterPoint Energy's cybersecurity risks. • The crisis management team, which includes senior executives across CenterPoint Energy, is alerted as appropriate to cybersecurity incidents, natural disasters, and business outages. This team has established and continually assesses CenterPoint Energy's communications plan in the event of a crisis. Additionally, as appropriate, the Audit Committee or the Board are made aware of significant cybersecurity incidents in accordance with our cybersecurity incident response playbook. • The Cybersecurity Awareness Governance Committee, which includes leaders from across CenterPoint Energy's corporate functions and business units, each with expertise in, or with specific responsibility for, managing or protecting CenterPoint Energy's assets, information and personnel. This committee provides strategic direction and oversight for CenterPoint Energy's cybersecurity awareness and training initiatives. • The Artificial Intelligence (AI) Steering Committee was established by CenterPoint Energy to provide strategic direction, oversight, and guidance in the planning, development, deployment, and management of AI initiatives within the organization. The committee's primary objective is to ensure that AI technologies are aligned with business goals, ethical considerations, appropriate security protections, and industry best practices while driving innovation and enhancing competitiveness.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: Risk Assessment; Third Party Assessments and Audits We use a combination of internal resources and external assessors, consultants, and auditors to conduct our cybersecurity risk assessments. At least annually, we conduct cybersecurity risk assessments that take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). We examine our cybersecurity controls, capabilities, programs, operating effectiveness, and incident response preparedness against industry standards and established frameworks, such as NIST and other guidelines. These assessments, which include third party audits for certain aspects of our cybersecurity, examine our end-to-end security practices, including data centers, infrastructure, and operations, and cover both physical as well as digital environments. Material results of assessments and audits are reported to our executive management team, the Audit and Compliance Committee, and the Board of Directors. The results of the assessment and audits are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity, and we seek to adjust our cybersecurity strategies and resources accordingly. We have also obtained certain industry certifications and attestations that demonstrate our dedication to protecting the data our members, customers, suppliers, employees, and other stakeholders.

companyName: Premier, Inc.


text: The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to Cyber attacks: We are vulnerable to cyber attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: During February 2024, the Company engaged HUB International as its national insurance broker and risk services consultant. HUB brings industry expertise specifically in regard to cybersecurity. (iii)

companyName: BOXABL Inc.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board of Directors and the Board's Audit Committee through our annual ERM assessment. Our cybersecurity policies and practices follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) maintaining the confidence of our customers, clients and business partners; (iii) preserving the confidentiality of internal and external information; and (iv) protecting the Company's intellectual property.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: We are committed to taking action to protect our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats, including those associated with our use of third-party service providers. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to our critical systems and information.

companyName: Envista Holdings Corp

ticker: NVST


text: We retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our president and chief operating officer, to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with the Company since its inception and has over 25 years of experience in cybersecurity.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: The Company's cybersecurity risks and associated mitigations are evaluated by the Company's management and Varagon periodically, but no less frequently than annually. Management and representatives of Varagon periodically report to the Board on information security and cybersecurity matters. Reports include, among other things, the overall state of the Company's cybersecurity program, information on the current threat landscape, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of material cybersecurity risks to the Company.

companyName: Varagon Capital Corp


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, public relations and financial risk areas.

companyName: SIMON PROPERTY GROUP L P


text: Our IT Director has cybersecurity knowledge and skills gained from over 15 years of information technology experience at the Company and elsewhere. Under his supervision, the IT Department, with the advice of outside consultants, is responsible for developing, implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Company's Vice President of Operations. The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats. Our IT Director works with the General Counsel and other members of the Legal Department to ensure compliance with legal, regulatory and contractual security requirements. The IT Director also periodically attends the Board's Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: We aim to incorporate industry best practices throughout our cybersecurity program. Identifying and assessing cybersecurity risk is integrated into our overall risk management program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is tested annually by independent third-party consultants. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect us, and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its Audit Committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our management, including our Vice President, Head of Computational & Structural Science, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: As part of planning for any suspected cybersecurity incident, the CIRT has developed certain incident response strategies to help collect and preserve forensic data, to mitigate the threat and to perform other activities to restore systems to normal operation. These strategies include many of the practices recommended by the U.S. Department of Homeland Security's Industrial Control Systems Computer Emergency Response Team. In addressing and resolving a significant cybersecurity incident, the Company may engage external experts in relevant fields, such as legal or forensic services, as needed. The Company also has a process whereby the Chief Information Officer (the "CIO") periodically meets with and assesses third-party service providers in order to help ensure the Company is made aware of any potential material cybersecurity threats or incidents in a timely manner. The Company's largest external service provider is CONA, as further discussed in "Item 1A. Risk Factors" of this report.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: Liberty Global's current CSO has significant experience leading cybersecurity efforts at large enterprises, having held top information security positions at a number of international large- and mega-cap companies during her career. She also holds a master of science in security risk management and is qualified as a certified information security manager with the Information Systems Audit and Control Association. Our CSO has been with the company or its subsidiaries for over five years.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Our cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, our cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team. We also engage the services of third-party consultants to assess and evaluate the effectiveness of our controls (in alignment with the NIST Framework), to improve our security measures and strategy, and to review our cybersecurity risk management program against the NIST Framework. The results of the most recent assessment of our cybersecurity risk management program confirmed the rigor of our cybersecurity risk management practices.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors, security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and external attack surface scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Management and Strategy Our cybersecurity program is designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company's broader risk management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, we utilize a combination of internal technology and a third-party managed security service provider and their platform to monitor, evaluate and respond to cyber activity. We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security approach, and make the necessary changes to address such findings.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a Security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, and to provide support during incident response efforts; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile. • There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Wag! Group Co.


text: As part of our information security program, our CISO and his team integrate our information security measures into our overall risk management processes to identify, evaluate, and quantify risks based on available information and classify the severity of potential cybersecurity incidents. XPO employs technical measures to protect against cybersecurity attacks that align with functions identified in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The information security team continuously reviews our information security systems for unauthorized system access, cybersecurity incidents, and unusual traffic on our systems and meets regularly to identify, assess, and manage cybersecurity threats, including those posed by third-party service providers who provide services to our business. Our information security team also reviews relevant legislative and regulatory developments and conducts regular and tailored information security training for our global workforce, in various formats.

companyName: XPO, Inc.

ticker: XPO


text: At IPM, cybersecurity is at the core of our business operations and an integral part of our commitment to delivering secure, compliant, and resilient technology solutions to customers operating in highly regulated industries. Prior to the Transactions, the Company employed a comprehensive strategy with respect to cybersecurity, which was supported by both management and our Board. Historically, our Board was responsible for overseeing our risk management activities in general, and certain of our Board committees assisted the Board in the role of risk oversight. The operations team prior to the Transactions conducted manual and automated testing of our systems, with the goal of identifying vulnerabilities and proactively strengthening our defenses.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — If we or our third-party providers experience significant disruptions of our IT Systems or data security incidents, this could result in harm to our reputation, subject us to liability, cause us to modify our business practices, and otherwise materially adversely affect our business, results of operations, and financial conditions."

companyName: Xperi Inc.

ticker: XPER


text: We have not identified risks from known cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors".

companyName: Global Clean Energy Holdings, Inc.


text: The Board of Directors provides supervision of cybersecurity risks to ensure the security of our company's operations. The Board of Directors receives quarterly updates on cybersecurity threats, vulnerabilities, and incidents from management, specifically from the Chief Digital Officer and IT Manager. These updates include information on the prevention, detection, and remediation of cybersecurity incidents, as well as monitoring key performance indicators, such as the effectiveness of security controls and overall cybersecurity posture.

companyName: Altus Power, Inc.


text: In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks.

companyName: CDT Equity Inc.

ticker: CDT


text: Like many businesses, the Bank faces numerous cybersecurity risks in connection with providing services to our customers. Guaranty does not currently believe that any current or pervious cybersecurity threats have materially affected, or are reasonably likely to materially affect the Bank, including its business strategy, results of operations, or financial condition. Unfortunately, the sophistication of cyber threats continues to increase, and the Bank's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. No cybersecurity program will be able to anticipate all cyber threats and breach attempts, and there may exist limitations to the ability to effectively implement preventive measures against such breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Bank's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.

companyName: GUARANTY BANCSHARES INC /TX/


text: Our cybersecurity risk management initiative includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Vertex, Inc.

ticker: VERX


text: Our cybersecurity program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incident. Exela owns and operates a 24 x 7 security operations center ("SOC") which monitors our global cybersecurity solutions and production environments, and serves as a central location for the reporting of cybersecurity matters. The roles and responsibilities of the SOC and our cybersecurity team in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation We partner with third parties to support and evaluate our cybersecurity program including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: Exela Technologies, Inc.

ticker: XELA


text: Given the importance to us of our cybersecurity program, in April 2022, our Board elected to exercise direct oversight of cybersecurity matters, rather than acting through its committees. The Board, as well as separately our executive management, receives, and has the opportunity to ask questions and raise discussion points regarding, management reports from the CIO and Senior Director of Cybersecurity and Network Operations on cybersecurity matters, as needed and no less than quarterly throughout the year, which reports include items such as cybersecurity updates, cybersecurity operational results, and audit findings. In addition, the Board and executive management receives and reviews the results of our cybersecurity risk and capabilities assessment on an annual basis.

companyName: Midstream Co LLC


text: We rely heavily on third parties to support our products, business operations and technology services, and a cybersecurity incident at a supplier, subcontractor or partner could materially adversely impact us. Where possible, we endeavor to include information security provisions, audit rights and insurance requirements, in contracts with our suppliers and third-parties based on their level of access to our systems and data. For our most critical suppliers, where possible, we attempt to pursue an annual attestation of ongoing compliance to our standard policies and practices. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor's officers detailing the Sponsor's annual due diligence on the Trust's service providers, including a summary of any potential operational risks and any incidents which could impact the Trust. The Board of Directors also periodically receives reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Our subsidiary operations in Worldcall Public are additionally subject to cyber security audits by Regulator (Pakistan Telecommunication Authority). The last audit for network security (Including Cyber Security) was conducted in 2023 with a clean report on compliance.

companyName: GlobalTech Corp

ticker: GLTK


text: Our Board and its Audit Committee are supported in their oversight of information technology and cybersecurity matters and risks by two management committees, the Operational Risk and Resilience Committee, which regularly reports to the Audit Committee, and the Information Security Steering Committee (the "ISSC"). The ISSC is responsible for providing management oversight for our cybersecurity risk management program, and its membership includes our Chief Technology Officer and Corporate Information Security Officer, among other members of senior management. Our Chief Technology Officer and Corporate Information Security Officer have each served in various roles in information technology and/or information security for many years, and have extensive information technology and cybersecurity experience. The Chief Technology Officer, and Corporate Information Security Officer, alongside other multidisciplinary teams across the Company, work to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The broad, cross-functional management team leverages significant experience and expertise across a range of areas, including in managing risk, technology, and legal and regulatory affairs, among others, for assessing and managing cybersecurity risks.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2023 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Business Operations - A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts." under "Item 1A. Risk Factors."

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: A key component within our ERM framework is a robust information security risk management program, which includes: • risk assessments designed to help identify risks to our critical systems, information, services, and our broader global information systems environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to aid in assessing specific risks, providing benchmarking data, providing information regarding trends or recent regulatory changes applicable to our risk profile, or to test or otherwise assist with aspects of our security processes; • the periodic engagement of an independent third-party expert to evaluate our security capabilities; • mandatory annual cybersecurity awareness training of our employees, including incident response personnel and senior management, as well as conducting periodic tests with our user population to reinforce good information security practices; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including those impacting the Company's manufacturing sites; • processes to identify vulnerabilities, breach attempts and possible criminal activity by external parties; and • processes to assess the practices of our suppliers and third-party service providers relative to protecting the security of our information.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: Our Information Security Program is aligned with applicable federal and state regulations, the Federal Financial Institutions Examination Council (FFIEC) Examination Guidance, and industry-accepted security standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, which are at the forefront of cybersecurity guidelines for federal agencies in the U.S. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including, but not limited to, advanced anti-malware and firewall technologies, anti-phishing and web filtering controls, robust patch management and vulnerability management processes, configuration hardening, participation with the Financial Services Information Sharing and Analysis Center (FS-ISAC) for sharing and consuming threat information, and we perform regular security testing to evaluate our defenses against real-world threats. We have an extensive information security training program that aims to regularly educate our colleagues on current best practices on handling sensitive information and expectations for protecting the organization and our customers. All employees complete mandatory cybersecurity training on at least a quarterly basis, including how to identify phishing attacks. Colleagues are tested regularly with simulated social engineering attacks to ensure awareness and preparedness. As an additional risk mitigation measure, the Bank maintains cybersecurity insurance in the event that a material incident does occur.

companyName: WAFD INC

ticker: WAFD


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, borrowers, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: The Audit Committee of the Board oversees management's cybersecurity risk management efforts. Our chief information officer oversees information technology, cybersecurity risk and efforts to prevent and mitigate such risks. The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, summaries of training activities and certification achievements, assessments of cybersecurity program effectiveness and reports on other cybersecurity priorities and initiatives. This is in addition to management's periodic updates on cybersecurity incidents involving the Company or other industry and global participants. The Audit Committee also receives regular updates on the efficacy of our cybersecurity program and risk management from our chief information officer and other members of management that are tasked with monitoring cybersecurity risks. Our chief information officer has over 10 years of experience overseeing cybersecurity teams at both the Company and two other public companies. Our chief information officer is supported by a dedicated team of certified cybersecurity professionals, with an average of over 13 years of relevant experience.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: We use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: Our information technology team is led by our Chief Information Officer who reports to our Chief Financial Officer and has extensive experience working with information security systems. Our information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with senior management, our cybersecurity governance committee, the Audit Committee and the Board. Our cybersecurity governance committee, comprised of our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of our information technology team are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies.

companyName: W. P. Carey Inc.

ticker: WPC


text: Guolin Tao will monitor the engineers responsible for the cybersecurity program to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Such engineers will keep Mr. Guolin Tao informed of relevant developments related to cybersecurity.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: The Company recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or the independent commission sales agents and third party capacity providers in our network; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals' risk identification and assessment.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: Our cybersecurity and IT executives include our CIO, who has 33 years of experience in Information Technology, including 20 years in the financial services space. His responsibilities as the CIO include information security oversight, and board reporting. Our CISO, has 18 years of experience in Information Security. The CISO holds certifications from leading security associations. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly train employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also have annual specialized training of our development staff that focuses on secure development best practices.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Cybersecurity risks are an important subset of Magnolia's overall risk management process. The Company considers the complexity of and reliance on cyber-connected systems in its risk assessment and prioritization. Magnolia's information security management processes and controls are based upon industry leading frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: The Company also maintains a system-wide information security program that applies to all employees. All employees are expected to assist in safeguarding the Company's information systems and to assist in the detection and reporting of cybersecurity incidents. This Company-wide program is intended to identify and assess internal and external cyber and information security risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems or those of third-party providers from unauthorized access, use or other malicious acts.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: ASB maintains a formal information security training program for all teammates that includes training on matters such as phishing and email security best practices. Teammates are also required to complete compulsory training on data privacy and the Code of Conduct.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program in a similar fashion to other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SMITH A O CORP

ticker: AOS


text: Our global information technology security team collaborates periodically with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity posture and preparedness. This collaborative effort extends to partnerships with the National Defense Cyber Alliance, National Security Agency, and the FBI to monitor and comprehend active risks within the Aerospace industry, Defense Industrial Base, and Critical Infrastructure.

companyName: Rocket Lab Corp

ticker: RKLB


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external advisors and service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and alignment with the broader corporate business continuity plan; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: Verona Pharma plc

ticker: VRNA


text: Our third-party cybersecurity team, which is responsible for our cybersecurity strategy and planning, oversees such efforts. As part of their efforts, such team seeks to identify potential cyber vulnerabilities and opportunities for improvement and then evaluates and implements different cybersecurity technologies to address any identified vulnerabilities and opportunities. However, this does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: Cyber App Solutions Corp.


text: Our information security program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through established policies, standards, reference architectures, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. Our proactive management of cybersecurity risks entails many actions, including the maintenance of system access restrictions, utilization of data security technology, employee education and training initiatives, and retention of cyber liability insurance, among other measures. We regularly engage third-party auditors and consultants and leverage our internal audit function to assess various facets of our cybersecurity program. These engagements include completion of industry-standard assessments or certifications, maturity model reviews, threat simulations, as well as internal reviews to assess the effectiveness of our cybersecurity processes. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. As examples, we generally review current and prospective third-party service providers for unacceptable cybersecurity risks, negotiate contractual provisions that require the establishment of third-party cybersecurity controls, and deploy communications security measures to protect third-party communications. For companies we acquire, the integration process includes plans for alignment with relevant information security policies and procedures and timelines for implementation.

companyName: ELI LILLY & Co

ticker: LLY


text: Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. As part of our enterprise risk management, we maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology, to support the effectiveness of our information technology systems and identify, prevent and mitigate information technology and data security risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: B&G Foods, Inc.

ticker: BGS


text: Board of Directors is actively engaged in overseeing and reviewing our strategic direction and objectives, taking into account, among other considerations, our risk profile and related exposures, including oversight of risks from cybersecurity threats. As part of this oversight, the Company established a Cybersecurity Steering Committee consisting of certain members of our senior management team and a Board representative, that meets quarterly and updates the Board periodically, and at least annually, on our cybersecurity program, including with respect to particular cybersecurity threats, cybersecurity incidents, new developments in our risk profile, the status of projects to strengthen our cybersecurity systems, assessments of our cybersecurity program, and the emerging threat landscape.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: Our IT management team is directly responsible for cyber security and maintaining of protection, keeping abreast of latest cyber security issues and concerns, monitoring threats, and the design and updating of policies and procedures along with appropriate education for all company employees. Our IT staff and management team have been trained on current industry standards and best practices and hold degrees and have experience necessary to have the skills necessary to address such threats. IT management is also responsible for the appropriate communications regarding threats and breaches should they occur and appropriate shut down and recovery activities and have action plans in place.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our cybersecurity risk management approach includes: (i) an enterprise risk management process, which includes cybersecurity risks and is periodically refreshed; (ii) system vulnerability scanning; (iii) cybersecurity training for employees; (iv) penetration testing, which simulates cyber threats; and (v) t hird-party risk management for suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that allow for periodic auditing. We work to continually improve each of these processes with the goal of ensuring our cybersecurity strategy remains consistent with industry best practices.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: To date, we have not identified any cybersecurity threats or past incidents that have had, or are likely to have, a material impact on our company's operations, business strategy, financial performance, or results of operations.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, "Risk Factors" under "Risks Related to Our Business–– Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients." We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future. Although we maintain cybersecurity insurance to mitigate potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will comprehensively protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: Our Vice President of Information and Business Systems provides quarterly briefings to the audit committee and board of directors regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: ESS Tech, Inc.

ticker: GWH


text: (iii) governance, risk, and compliance defining policies, standards, and systems of control and measurement in line with industry best practices and regulatory requirements;

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: We strive to create a culture of cybersecurity resilience and awareness and believe that cybersecurity is the responsibility of every employee and contractor. At the same time, primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our CISO, Michael Daly. Mr. Daly has more than 35 years of experience in security and information systems and spent 25 years with Raytheon Technologies, most recently as Chief Technology Officer of Cybersecurity, Special Missions, Training & Services. Mr. Daly supported the U.S. President's National Security Telecommunications Advisory Committee for more than 20 years, is a member of the Massachusetts Cybersecurity Strategy Council, and is Chair of the Kogod Cybersecurity Governance Center at American University. Formerly, he served on the Rhode Island Homeland Security Advisory Board and was a member of various commercial cyber product councils.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: We employ industry-leading security tools and conduct regular security risk assessments and tool reviews with independent third parties to evaluate program effectiveness and inform our security roadmap. The Cybersecurity Program also includes continuous monitoring of industry news and updates to maintain awareness of the evolving cybersecurity landscape, including potential incidents or issues involving third-party service providers.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: We view cybersecurity threats as a shared responsibility. All new employees with company email addresses receive cybersecurity training as part of their onboarding, as well as annual training. We also periodically publish a cybersecurity newsletter to these employees related to topics such as phishing, social engineering, and insider-threat awareness.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Although we are not aware of having experienced any prior material data breaches, regulatory non-compliance incidents, or cyber security incidents, we may in the future be impacted by such an event, exposing our clients and us to the risk of someone obtaining access to our information, to the information of our clients or their customers, or to our intellectual property, disabling or degrading service, or sabotaging systems or information. Any such security incident could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation, and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss. For additional information, see "Item 1A. Risk Factors" of this Annual Report.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Audit Committee of the Company's Board of Directors (the Audit Committee) oversees the Company's cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company's Chief Information Officer. The Company's Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company's Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company's cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company's cybersecurity team provides periodic reports to such auditors.

companyName: STEPAN CO

ticker: SCL


text: We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001 ("ISO 27001") Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST or ISO 27001.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, and, as appropriate, provides briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Because our products collect and store visitor and related information and images, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products."

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: In the ordinary course of business, our information systems on which we run our business operations and store confidential or proprietary data, such as PII about our customers and our employees, are subject to potential cyber-attack. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology ("IT") systems. We have implemented security measures that are designed to detect and protect against cyberattacks. In particular, we seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment:

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Our cybersecurity and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. Such leaders in our organization hold industry recognized certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Global Information Assurance Certification (GIAC).

companyName: CORVEL CORP

ticker: CRVL


text: IT Management and General Counsel are explicitly informed by the internal security team and Managed Security Service Provider (MSSP) of incidents and periodically updated on the investigation progress and impact of the incident. Management also receives explicit monthly summaries on all incidents. Major incidents are reported to company management and summarized at an annual management review meeting.

companyName: BADGER METER INC

ticker: BMI


text: Cybersecurity is a critical component of our risk management process. We recognize that no single technology, process, or business control can effectively prevent or mitigate all risks, thus we use a variety of tools including multi-factor authentication and antivirus and firewall protection, to help identify, protect, detect, respond to, and recover from cyber threats. These individual technologies work together as part of our strategy to minimize risk. This strategy is tested through audits and independent program assessments, as well as through additional exercises with our Managed Service Provider, designed to assess effectiveness. The Managed Service Provider actively manages our firewalls, multi-factor authentication, antivirus, and Azure environment. Our Managed Service Provider also reviews our cybersecurity program on a quarterly basis and provides recommendations toward best industry practice. Our cybersecurity program is continually evolving to align with NIST standards, and we regularly monitor our progression toward these standards.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: a third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents;

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Risk and Threat Management Our Enterprise Cybersecurity Risk Management program is a continuous life cycle approach with a formal annual risk assessment followed by internal and third-party risk assessments throughout the year. Annually, an independent security expert vendor is engaged to conduct a cybersecurity risk assessment based upon industry and technology standards. The assessment results are prioritized then tracked within our Governance, Risk and Control system which derives the specific risk likelihood and impact mitigated risk score. Cybersecurity projects, controls and practices are then developed to mitigate the identified risks. Monthly, the Compliance and Security Steering Committee meets to review risk register, current threat assessments and related mitigation efforts for risk management tracking. Additionally, on a quarterly basis, our Chief Information Officer ("CIO") presents the risk score and mitigation updates to the board of directors of our GP for risk oversight.

companyName: NGL Energy Partners LP

ticker: NGL


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We face cybersecurity risks in connection with our business operations. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to our data and systems, including social engineering threats, denial of service attacks, malware and computer virus attacks. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors.

companyName: National CineMedia, Inc.

ticker: NCMI


text: As discussed in more detail below under the heading "Governance," the Board of Directors' oversight of cybersecurity risk management is led by the Audit Committee of the Board of Directors (the "Audit Committee"), which interacts quarterly with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Our cybersecurity program is focused on the following key areas: • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, an endpoint protection platform system, anti-malware functionality, email filtering, url filtering and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats, as well as periodic decoy and honeypot testing, as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Assessments of Third Party Service Providers. We regularly evaluate the cybersecurity policies, standards, processes and practices of our key third party service providers in order to effectively identify and address any vulnerabilities or other risks. • Incident Response and Recovery Planning. We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Collaborative Approach. We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management.

companyName: Cyngn Inc.

ticker: CYN


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: The Company has implemented policies and procedures related to disclosing their cybersecurity risks and management strategies in their annual report, SEC filings, or other regulatory filings providing investors with an understanding of the potential impact on the Company's operations and financials.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: SLB has a Cybersecurity Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.

companyName: SLB LIMITED/NV

ticker: SLB


text: Our Board of Directors ("Board") is informed about cybersecurity risk matters pertaining to the Company and its operations as part of our overall enterprise risk assessment. At least annually, or more frequently as necessary, the Board receives cybersecurity briefings and is apprised of cybersecurity incidents deemed to pose significant risk to us. Our internal controls and procedures are designed to provide for the identification, notification, escalation and communication of cybersecurity incidents to management, including when appropriate to the Board, so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.

companyName: MOOG INC.

ticker: MOG-A


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Product security vulnerabilities, system security risks, data protection breaches, cyber-attacks and improper use of artificial intelligence tools, could disrupt our products, services, internal operations or information technology systems, and any such disruption could increase our expenses, damage our reputation, harm our business and adversely affect our stock price".

companyName: NETGEAR, INC.

ticker: NTGR


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We have developed an incident response plan to manage identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. The incident response plan sets forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. In addition to our in-house capabilities, we engage with key security and technology vendors, industry participants and intelligence communities to assess our program and test our technical capabilities and enhance the effectiveness of our information security policies and procedures. We use a combination of tools and technologies to protect AMN Healthcare and the personal information we maintain and operate a proactive threat intelligence program to identify and assess risk. We have also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party vendors, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Our Manager of Information Technology, who has over 25 years of information technology experience, and our Chief Operating Officer, who has over 15 years of information technology management experience, manage the risk assessment and mitigation process.

companyName: Peraso Inc.

ticker: PRSO


text: Since our commencement of operations, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Past or future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report.

companyName: 26North BDC, Inc.


text: Our senior management team, including the Senior Director, IT and Facilities, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Senior Director, IT and Facilities has over 20 years of industry experiences leading and overseeing cybersecurity programs at public and private companies.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, refer to the risk factor captioned "Despite implementing and maintaining industry standard security measures and controls, the website, systems and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales." in Part I, Item 1A. "Risk Factors.".

companyName: NET Power Inc.

ticker: NPWR


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees Mattel's assessment and management of material cybersecurity risks. The CTO reports to the Audit Committee on Mattel's cybersecurity, including material cybersecurity risks and mitigation, at least annually. The CTO reports and escalates cybersecurity incidents to management and the Audit Committee as appropriate.

companyName: MATTEL INC /DE/

ticker: MAT


text: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan ("Incident Response Plan"), which is administered by our Chief Information Security Officer ("CISO") in close collaboration with our Director of Enterprise IT Risk. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents. The Incident Response Plan is intended to proceed on parallel paths in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business, communications, and risk personnel. Our incident response team annually performs exercises to simulate responses to cybersecurity events.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: Management's Role Managing Risk The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology ("NIST") security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to promote the efficacy of our security measures. Furthermore, the program includes a formal information security training program for that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.

companyName: AMERICOLD REALTY TRUST

ticker: COLD