text: Our VP of IT semi-annually and on an ad-hoc basis presents directly to the Audit Committee on cybersecurity initiatives, efforts, and security risks. The Audit Committee reports to the Board at minimum semi-annually the cybersecurity initiatives, efforts and security risks. In addition, we have an Incident Response Policy in place to inform senior management and the Board of material issues related to cybersecurity matters and to develop an appropriate response plan.

companyName: Titan Machinery Inc.

ticker: TITN


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats We rely on the cybersecurity strategy and policies implemented by Ares, the parent company of our Advisor. Ares' cybersecurity strategy prioritizes the detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Ares' enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Ares' cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Ares has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE

secItem: Item 1C


text: Before purchasing third-party technology or other solutions that involve exposure to the Company's systems or electronic information, we conduct a cybersecurity review of such third parties. This cybersecurity review involves the vendor's completion of questionnaires and, as appropriate, participation in cybersecurity audits.

companyName: Fusion Pharmaceuticals Inc.


text: 2024, we did not identify any cybersecurity breaches that materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: Our Cybersecurity Oversight Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our Incident Response Plan (IRP), all of our employees are trained to report a suspected cybersecurity incident or breach to our information technology team. Reporting guidelines under the IRP describe how to report an incident and what details to include. As a first step under the IRP, our information technology team assesses the reported risk or breach and escalates it to our Incident Response Team (IRT), as appropriate. The IRT is comprised of the members of our Cybersecurity Oversight Team and other critical business function leaders, including members of our legal and communications teams. Following notification from our information technology team, the IRT is responsible for continuing to assess the suspected risk or breach to determine its potential impact on our organization, systems and data. Based on that assessment, the IRT may raise the incident or breach to other members of management or the audit committee for further review and triage.

companyName: Nuvalent, Inc.

ticker: NUVL


text: Pursuant to the Shared Services Agreement, the Company depends on the proper functioning, availability and security of SITE Centers' information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties. SITE Centers grants limited access to its systems to third parties providing specific outsourced functions or other services and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the critical information systems on which the Company relies, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees and others, could result in liability for the Company and have a significant impact on the Company's operations and reputation.

companyName: Curbline Properties Corp.

ticker: CURB


text: We also engage external vendors to conduct external vulnerability scanning and assess our policies and practices. To safeguard critical systems, we maintain encrypted, immutable backups and conduct regular testing to confirm their confidentiality, integrity and availability. These efforts are reinforced by routine disaster recovery tabletop exercises and restore testing, ensuring that our organization is prepared for any potential disruptions. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors and other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. For instance, we engage third-party consultants to perform annual walkthroughs and design testing of information technology, or IT, general controls on behalf of our Internal Audit team, as well as to test IT control effectiveness throughout the year.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the Chief Information Officer ("CIO").

companyName: STONERIDGE INC

ticker: SRI


text: Management is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our Head of IT and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Management regularly updates the board of directors on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides regular cybersecurity updates.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: Our information technology, communication networks, enterprise applications, accounting and financial reporting platforms and related systems are integral to our operations. We use these systems, among others, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our operations rely on securing, collecting, storing, transmitting, and processing of proprietary and confidential data.

companyName: BRT Apartments Corp.

ticker: BRT


text: Board and Audit and Finance Committee Governance Our board of directors (the Board) manages cybersecurity risks as part of the company's overall risk management framework. The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee). The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding our company's cybersecurity risk management program and cybersecurity-related risks. The Audit Committee consists of Board members with diverse expertise in risk management, technology, finance and cybersecurity, including oversight of security teams. Our CISO provides the full Board with written quarterly and annual reports on our cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.

companyName: GoDaddy Inc.

ticker: GDDY


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of the third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: For information about risks from cybersecurity threats, see the Windstream Prospectus, under the caption "Risk Factors—Risks Related to the Merger—Cybersecurity incidents could have a material adverse effect on New Uniti's business, results of operations and financial condition."

companyName: Uniti Group Inc.

ticker: UNIT


text: The IT Committee is chaired by Dr. Yonesy F. N ez, CISSP, who holds a Doctor of Professional Studies in Computing Information Assurance and Security from Pace University. Dr. N ez has experience in cybersecurity governance and risk management and currently serves as Chief Information Security Officer ("CISO") of a Systematically Important Financial Market Utility. His prior roles include CISO at Jack Henry & Associates and senior cybersecurity positions at major financial institutions.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that we will not be materially affected in the future by such risks or future cybersecurity incidents. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Report.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: The Audit Committee oversees the Company's security risk management practices, including overseeing the practices, procedures, and controls that management uses to identify, assess, respond to, remediate, and mitigate risks related to cybersecurity. Senior leadership, including the Senior Vice President and CIO, updates the Audit Committee and the Board of Directors at least quarterly regarding cybersecurity risks, strategies and policies.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: We maintain comprehensive policies and procedures designed to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: We recognize the critical role of employees in maintaining cybersecurity resilience. Accordingly, we provide cybersecurity training and awareness programs to educate employees about security best practices, phishing awareness, and the importance of safeguarding sensitive information.

companyName: GSE SYSTEMS INC


text: We employ information systems to support our business. As is the case for other manufacturing companies of comparable size and scope, we, from time to time, experience attempted cyber-attacks on our information system. We also face risks associated with other potential significant failures or disruptions of our information technology networks. We utilize a risk-based, multi-layered information security approach that incorporates some of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have adopted and implemented this approach to identify and mitigate information security risks in a manner that we believe is commercially reasonable for manufacturing companies of our size and scope.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: Dana maintains a risk management program overseen by our Executive Leadership Team. Our Senior Vice President and Chief Financial Officer and Senior Vice President, General Counsel and Secretary / Chief Compliance and Sustainability Officer (General Counsel) have responsibility for our risk management program. In addition, our Business Unit Presidents and functional leads oversee strategic and operational risks, including cybersecurity risks. Cybersecurity is a top priority, and our cybersecurity program is driven by our commitment to maintaining a strong security architecture, active governance, and robust controls. Our cybersecurity program is led by our Director of Cybersecurity and GRC (DOC) and overseen by Dana's Enterprise Cybersecurity Steering Committee (ECSC). The ECSC is sponsored by senior leaders from disciplines such as Information Technology, Legal, Human Resources, Engineering, Product Development, and Operations, and includes the Senior Vice President and Chief Information Officer (CIO); General Counsel; Senior Vice President and Chief Human Resources Officer; Senior Vice President and Chief Technology Officer; and Senior Vice President Global Operations. The ECSC is responsible for developing and overseeing strategies related to Dana's cybersecurity program. As set forth in its charter, our Technology & Sustainability Committee, comprised of independent directors, has oversight responsibilities for cybersecurity risk and includes members with significant cybersecurity experience. The DOC and CIO regularly provide updates on Dana's cybersecurity program to the Board and the Technology & Sustainability Committee.

companyName: DANA Inc

ticker: DAN


text: Our CISO is responsible for the development and execution of the security strategy which protects Allstate's information from external and internal cybersecurity threats. He has more than 20 years of information security leadership experience.

companyName: ALLSTATE CORP

ticker: ALL


text: The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management strategy and have been embedded in the information systems operating procedures and internal controls.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard / dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Information Security Officer. Our audit committee also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: DermTech, Inc.


text: Finally, we conduct cybersecurity training and awareness programs for relevant employees and periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: The Company relies on third-party service providers for critical or key infrastructure and solutions across various Company operations. Cybersecurity incidents that impact third-party service providers have significantly increased in recent years and represent a continuing risk to the Company. The Company has sought to mitigate this risk through specific cybersecurity controls, designed to assess the business and security controls implemented by key information services to the Company. The management assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: Okta has an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems, internal networks and information. This program implements policies, processes and controls to respond to cybersecurity threats and mitigate business impacts. Okta's board of directors (the "board") has delegated to the cybersecurity risk committee of the board (the "cybersecurity risk committee") oversight responsibility of the cybersecurity risk management program, which includes a cybersecurity incident response plan.

companyName: Okta, Inc.

ticker: OKTA


text: We use various tools and methodologies to manage cybersecurity risk, including the implementation of a business continuity process that includes a comprehensive Information Security Incident Response Plan ("InfoSec IR Plan") that is tested on a regular basis. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through cybersecurity awareness training to equip employees to avoid falling victim to phishing attempts, and we enforce strong password requirements and use multi-factor authentication. We conduct regular vulnerability scans, penetration tests, utilize threat intelligence feeds, and conduct external annual penetration testing by an independent third party.

companyName: AdTheorent Holding Company, Inc.


text: To actively manage cybersecurity risks identified as part of the ERM process or otherwise and to manage emerging cybersecurity threats in real time, management has implemented an ISO 27001 certified Information Security Management System. Our Cybersecurity Team operates a Security Operations Center that continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our CIO, who briefs senior management, including our CEO, as well the Innovation and Cyber Committee of our Board (the "Innovation and Cyber Committee") and the Audit Committee of our Board (the "Audit Committee"), as appropriate. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. The Audit and Finance Committee is charged with oversight of data privacy and cybersecurity risks. Our CISO provides updates to either the Audit and Finance Committee or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • compliance with regulatory requirements and industry standards; and • updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: The CISO reports to the Chief Information Officer ("CIO") and is responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has served in various information technology and security leadership roles for over 20 years, including serving as the Chief Information Security Officer at 8x8 Communications and Lam Research Corporation. He holds a B.S. degree in Information Technology from the University of the Pacific and an M.B.A. from the University of Southern California.

companyName: RingCentral, Inc.

ticker: RNG


text: Our Information Technology team which reports to senior management, is responsible for maintaining our cybersecurity risk management program. They collaborate with third-party security specialists as they believe necessary to conduct thorough risk assessments and system improvements. Together with our third-party security service providers, the Information Technology team oversees cybersecurity incidents, prevention, detection, mitigation, and resolution. We regularly train our employees on cybersecurity awareness and confidential information protection and continuously review and update our policies to adapt to the evolving threat landscape and legal developments.

companyName: AstroNova, Inc.

ticker: ALOT


text: The oversight of our cybersecurity program at the management level rests with the Executive Leadership Team ("ELT") who has designated the CISO to lead and execute on the cybersecurity program. The CISO provides regular updates to the executive leadership team, including the CEO, on our cybersecurity program and cybersecurity risks. Our cybersecurity leaders have extensive experience in cybersecurity, including in consulting and corporate roles at Forbes 100 companies and experience leading security incident detection and response, security architecture, and strategy programs.

companyName: Edwards Lifesciences Corp

ticker: EW


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: The Vice President of Technology, Data, and Security leads an information security team responsible for management of cybersecurity risk. The Vice President of Technology, Data and Security has decades of experience relevant to risk management, information systems and enterprise security. The Vice President of Technology, Data and Security serves on the Corporate Risk Oversight Committee where cyber risks are regularly discussed and addressed. The Registrants' Corporate Risk Oversight Committee includes corporate officers and members of management and is responsible for the overall development, implementation and enforcement of strategies and policies for all significant risk management activities of the Registrants.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Disclosure of the Board ' s Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.

companyName: AvePoint, Inc.

ticker: AVPT


text: Although we have not historically experienced significant cybersecurity incidents, we and other banks are subject to attacks of increasing frequency and sophistication. Any significant breach, interruption or failure of our information systems could adversely affect our business operations and our financial condition, operating results and liquidity.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: We rely on information technology and data to operate our business and develop and advance our pipeline of product candidates. Our critical information technology includes computer networks, third-party hosted services, communications systems, software and infrastructure, and our critical data includes confidential, personal, proprietary and sensitive data (collectively, Information Assets). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our Information Assets and mitigate harm to our business.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: The information provided by these processes facilitates management's ongoing assessment of our cybersecurity risk environment and provides current and accurate information regarding cybersecurity risks to management, our Audit Committee and Board of Directors to allow appropriate management of such risks through remediation or other risk mitigation activities.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: To safeguard critical data and systems, support regulatory compliance, manage our material risks from cybersecurity threats, and identify, assess and respond to potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we: • Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate; • Utilize Endpoint Detection and Response (EDR) tools to help us prevent, detect, and respond to endpoint threats with real-time visibility across our infrastructure and devices, enterprise-wide; • Provide periodic, but no less than annual, training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems; • Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources; • Implement regular phishing simulations and processes for reporting phishing events and concerns to enhance staff awareness, vigilance, and responsiveness; • Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts; • Employ elements of the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and • Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.

companyName: ARTIVION, INC.

ticker: AORT


text: The Bank's CISO provides quarterly reports to OROC which include vulnerability management and security incident metrics, the status of security awareness training (including phish-testing results), and the status of any risk-accepted items and remediations. The quarterly reports also include any significant findings from audits, third-party security assessments, and penetration tests. Monthly, the CISO briefs the CRO, CIO, and the Bank's Chief Executive Officer regarding any significant IT security items.

companyName: Federal Home Loan Bank of Dallas


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.. Our third-party consultant team is managed by our Chief Financial Officer who reports to the Audit Committee at the board level, as appropriate.

companyName: SmartKem, Inc.

ticker: SMTK


text: Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. Our cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of our security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, we have established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to the Company Board.

companyName: LGAM Private Credit LLC


text: The audit committee has formal oversight responsibility for cybersecurity and is responsible for reviewing the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, the Chief Information Officer ("CIO") provides quarterly updates to the audit committee with respect to cybersecurity incidents, mitigation, and management.

companyName: AGREE REALTY CORP

ticker: ADC


text: The Company is not aware of any current cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for additional information regarding the risks we face from cybersecurity threats.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: HARMONIC INC.

ticker: HLIT


text: We devote significant resources, including human and financial capital, to create security measures, configuration policies and response plans to address cybersecurity threats. However, as a well-known provider of identity and security solutions, Okta, Inc. is a particularly attractive target to threat actors. For additional information related to these risks, see " Risk Factors " included under Part I, Item 1A of this Annual Report on Form 10-K. In the past we have experienced cybersecurity incidents, and cannot anticipate when or the extent to which cybersecurity incidents will materially affect us or our customers' use of our platforms in the future. To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks related to cybersecurity threats or incidents. There can be no assurance that Okta, Inc.'s cybersecurity risk management program and processes will be fully implemented. Even if implemented, they may not be complied with or may not effectively protect our systems and information or those of our customers.

companyName: Okta, Inc.

ticker: OKTA


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. However, as of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we have faced in the past and expect to continue to face in the future, please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: To date, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business operations or financial condition. Despite the extensive approach we take to cybersecurity, prevention of a cybersecurity incident cannot be completely guaranteed. Please refer to "Item 1A. Risk Factors – We rely on information technology and security systems and any damage, interruption or compromise of our information technology and security systems or data could disrupt and harm our business" and "Item 1A. Risk Factors – A breach of our information technology and security systems could materially adversely affect our business" for further information.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee of the Board (the NCG Committee) overall oversight of cybersecurity matters and other policies and internal controls regarding cybersecurity risks. The Audit Committee of the Board (the Audit Committee) is responsible for oversight of disclosure controls with respect to potential cybersecurity incidents as well as the Company's compliance with SEC rules applicable to cybersecurity risk management.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: As noted above, the Company's cybersecurity risk management process is integrated into our overall Enterprise Risk Management framework, which is overseen at the management level by senior leaders of the Company.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity, including risks arising from our use of third-party providers software and service providers. In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing. Every year, employees must take and pass rigorous information security and protection training.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including appropriate measures suggested by security standards, an incident response plan, incident detection and response, vulnerability management process, disaster recovery/business continuity plans, risk assessments, data encryption, network security controls, access controls, physical security, vendor risk management program, employee training, penetration tests, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about risks related to cybersecurity threats, refer to Item 1A. "Risk Factors."

companyName: TransDigm Group INC

ticker: TDG


text: Our Vice President of IT Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall IT risk management strategy, communicating key priorities to relevant personnel, overseeing cybersecurity operations, and managing the cybersecurity technologies, processes, and projects. Our Vice President of IT is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and conducting regular reviews of security assessments and other security-related reports.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: As part of our overall Enterprise Risk Management ("ERM") program, we employ a cybersecurity program of technical, administrative, and physical controls intended to reduce the risk of cyber threats and protect our information, as well as documented processes to determine and make appropriate disclosures regarding potential material threats and incidents. Our cybersecurity philosophy and approach align to the National Institute of Standards and Technology Cybersecurity Framework and its core elements to identify, protect, detect, respond, and recover from the various forms of cyber threats. Our practices include, but are not limited to, cybersecurity protocols and controls, system monitoring and detection, communication of incidents to appropriate management, third-party risk management, including assessments of emerging threats and vulnerabilities, and ongoing privacy and cybersecurity training for employees and contractors concerning cyber risk. A foundational element of our cybersecurity risk management processes is the annual Cybersecurity and Information Security Risk Assessment (CSRA), which includes an analysis of cybersecurity risks facing us and associated recommendations and action items to mitigate identified risks. We periodically utilize third parties to assess the effectiveness of our cybersecurity efforts through independent validations, verifications, and security assessments.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to BREIT.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: In particular, the Company outsources its information technology function and monitoring to a third-party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third-party consultant.

companyName: Ondas Inc.

ticker: ONDS


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate risk, including reputational damage.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: HUMBL, INC.

ticker: HMBL


text: In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents. This includes penalties and settlements, of which there were none.

companyName: Vericel Corp

ticker: VCEL


text: Monitoring Cybersecurity Incidents The CIO and CISO utilize vendor relationships, the Financial Services Information Sharing and Analysis Center and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring. The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy, and Information Security teams.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Change and Configuration Management Our change and configuration management policy and procedures enable the effective management of changes to Information Systems ("Changes") to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and IT services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners.

companyName: Clene Inc.

ticker: CLNN


text: Our CISO leads our global information security organization responsible for overseeing the Grindr cybersecurity program which is designed to maintain the confidentiality, integrity and availability of Grindr's data assets. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public and private companies. Team members who support our cybersecurity program have deep educational and industry experience. The CISO attends quarterly meetings with our Audit Committee and meets with Grindr's Board of Directors at least annually to brief them on security matters including ongoing cyber threats and risks.

companyName: Grindr Inc.

ticker: GRND


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Information Technology and management. Personnel at all levels and departments are made aware of our cybersecurity engage consultants, or other third parties in connection with our risk assessment processes if required. These service providers assist us in designing and implementing our cybersecurity policies and procedures. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer ("CIO") as part of our enterprise risk management ("ERM") process. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our "Cybersecurity Team").

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Our cybersecurity program is managed by our SVP, Security Engineering, who reports to our Chief Technology Officer. Our SVP, Security Engineering, has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Our information security program encompasses partnerships among teams that are responsible for cyber governance, prevention, detection and remediation activities within our cybersecurity environment. Team members have relevant certifications, educational and industry experience, including experience holding similar positions at other large technology companies. The information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our information security leadership reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. We also maintain an escalation process to inform senior management and the Board of Directors of material issues and make determinations with respect to any required disclosures.

companyName: Match Group, Inc.

ticker: MTCH


text: As previously disclosed, beginning on August 18, 2023, some of the notified individuals filed lawsuits against Umpqua Bank in various federal and state courts seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The cases collectively allege claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, invasion of privacy, breach of the covenant of good faith and fair dealing, unjust enrichment and violation of certain statutes, namely the Washington Consumer Protection Act, the California Consumer Legal Remedies Act, the California Consumer Privacy Act, and the California Unfair Competition Law. Umpqua Bank has engaged defense counsel and intends to vigorously defend against these suits and any similar or related suits or claims. Umpqua Bank has notified relevant insurance carriers and business counterparties and continues to reserve all of its relevant rights to indemnity, defense, contribution, and other relief in connection with these matters. We cannot predict or determine the timing or outcome of these lawsuits or the impact they may have, if any, on our financial condition, results of operations or cash flows. We believe that if one or more outcomes that are determined in favor of the plaintiffs in the litigation arising from the Vendor Incident it could have a material adverse effect on our business, operations, or financial results.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Board Governance The Board views cybersecurity as part of the Company's overall enterprise risk management function, which the Board oversees. The Board takes cybersecurity into account as part of the Company's business strategy, financial planning and capital allocation.

companyName: ROBERT HALF INC.

ticker: RHI


text: As part of the Company's overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company's internal audit department collaborates with the Company's information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.

companyName: MP Materials Corp. / DE

ticker: MP


text: Our CSO and cybersecurity team actively monitor Liberty Global's systems, regularly review its policies, compliance, regulations and best practices, perform penetration testing, conduct incident response exercises and internal ethical phishing campaigns and provide periodic training and communication across the organization to strengthen secure behavior and foster a culture of digital security. The cybersecurity team also routinely participates in industry-wide programs to further information sharing, intelligence gathering and unity of effort in responding to potential or actual attacks. Liberty Global also periodically reviews its business continuity plan to develop an effective recovery strategy that seeks to decrease incident response times, limit financial impacts and maintain customer confidence during any business interruption. Our cybersecurity team also administers a third-party risk governance program that identifies potential risks introduced through third-party relationships, such as vendors, software and hardware manufacturers or professional service providers. Liberty Global also seeks to obtain certain contractual security guarantees and assurances with these third-party relationships to help ensure the security and safety of its information. The cybersecurity team works closely with a broad range of departments, including legal, regulatory, corporate communications, audit services, information technology and operational technology functions critical to Liberty Global's operations, as well as engages external vendors to help ensure its cybersecurity program operates effectively.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: We rely on third-party service providers to deliver our products and services to our customers, including many of our technology initiatives. A cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially adversely impact us. We evaluate third-party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire, and include security and privacy addenda to our contracts where applicable. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Despite taking extensive precautions, cybersecurity incidents are still possible. In general, when our cybersecurity team detects a cybersecurity threat by way of an alert within our cyber defense systems, employee notice, or otherwise, our IT Director, Cyber Security, along with other relevant personnel, is promptly apprised of the situation, and actively takes steps to prevent, mitigate, or remediate that threat. If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT's incident manager and the CDO or designee notifies the Chief Risk Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT, and may consult other internal and external resources with the required technical, application, organizational, and business knowledge to provide effective advice to the CIMT.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: Failed system: Our cybersecurity policies contemplate enterprise system failures due to cyber-attacks, network connections, hardware challenges, bottleneck problems and other issues. We seek to mitigate these potential vulnerabilities through monitoring and redundancy.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: c.promoting compliance with AT&T's security policies and network and information security program in a consistent manner on network systems and applications; and d.providing security thought leadership in the global security arena.

companyName: AT&T INC.

ticker: T


text: Ohio Valley recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As a result, the Company has devoted significant financial and personnel resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of the Company's Information Security Program; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert us of potential threats;

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: We have an Information Technology committee that meets at least quarterly and includes members of our management team and compliance team. The members of the Information Technology committee have gained cybersecurity experience through years of training, internal and external discussions, and the development, implementation, and periodic evaluation of our cybersecurity policies.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: The CISO, reporting to the CIO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our CISO has significant relevant experience in the area, including graduate and postgraduate engineering technology degrees, along with 20 years of information security experience in critical infrastructure, as well as seven years with Norfolk Southern where he guided the Company through the implementation of our multi-layered defensive cybersecurity strategy that aligns with the NIST CSF. As noted above, our technology risk working group, comprised of leaders across the information technology, information security and law departments, including our CIO, CISO and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The Board is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's risk management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Risk Committee of the Board. The Risk Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the CISO and the Head of Information Risk and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.

companyName: Veritex Holdings, Inc.


text: Ongoing Monitoring Based on the residual risk score of a third party, we conduct assessments on a periodic basis to help ensure that we maintain current information on our vendors. We leverage an external third-party monitoring service to conduct continuous monitoring of our critical vendors to provide additional visibility and response efforts and work directly with vendors to remediate identified vulnerabilities. Finally, we review contracts that outline risk management responsibilities, compliance requirements, data protection and incident management protocols.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile, and in 2024, a third-party cybersecurity consultant reviewed the Company's vulnerability management program These reviews assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.

companyName: SouthState Bank Corp

ticker: SSB


text: Our Vice President of Information Technology ("VP-IT") leads our cybersecurity initiatives, reporting directly to the Chief Administrative Officer and Corporate Secretary and maintains open communication channels with the broader senior management team, the Board, and our Audit Committee. The VP-IT is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident response, and regularly and routinely reviewing our security model and its practices and future initiatives with external auditors to ensure alignment with industry best practices, changes in audit compliance requirements, and adherence to planned business objectives, as well as providing regular updates and reports on our cybersecurity status and risk assessments to the Board. The VP-IT has over 25 years of information technology management experience and has served as our VP-IT since January 2024.

companyName: CIVITAS RESOURCES, INC.


text: Although, to date, cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition, there can be no assurances that they will not do so in the future. Refer to "Item 1A. Risk factors" in this Annual Report for additional information about cybersecurity-related risks.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: In alignment with enterprise risk management processes and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Company has developed a control environment to prevent, detect, respond to, and recover from cybersecurity risk events. The Company's control environment includes policies that set consistent cybersecurity control benchmarks across the organization and inform the CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents on an ongoing basis.

companyName: EVANS BANCORP INC


text: Training and education - We require employees and contractors to complete data protection and security awareness training in connection with onboarding and annually thereafter. These trainings cover a wide range of topics, including, but not limited to, ransomware, impersonation attacks, data handling and privacy, fraud, phishing, and identity theft. From time to time, we also require supplemental training depending on an individual's role or job responsibilities. Our CISO also periodically presents on cybersecurity matters at company-wide meetings and with individual business and corporate functions.

companyName: Dynatrace, Inc.

ticker: DT


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: Danimer Scientific, Inc.


text: management and strategy are an R&D stage pharmaceutical company, with no commercial operations or revenue streams. Since our IPO, our sole business activity has been ongoing research into our drug therapies]. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently.

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: We engage external vendors to assess the cybersecurity program as needed. An independent third party will perform annual multi-stage penetration testing of our IT environment.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: The Company regularly reviews the nature of its business activities and modifies the CSP as appropriate. Many of the elements of the CSP are cyber defense related and are in place to reduce our risk to a wide range of potential cyber threats that may target our assets and information daily. The effectiveness of the CSP is assessed and measured periodically by various lines of defense within the Company and is conducted primarily through risk assessments, assurance testing, and an independent audit. External organizations are also routinely engaged to assess our CSP and test our perimeter defenses. The effectiveness of the CSP is reported periodically to the appropriate governance committees.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: annual cybersecurity training for all employees with additional supplemental cybersecurity and automated cyber controls in conjunction with robust detection, mitigation, and recovery the formation of a multidisciplinary cybersecurity incident response team; integration of multiple threat intelligence sources into our cybersecurity tools and processes; retention of external cybersecurity threat response resources;

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: o Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.

companyName: BlackRock Direct Lending Corp.


text: Our cybersecurity risk management program seeks to proactively identify, assess, and mitigate risks from cybersecurity threats. Key components include informal self-assessments, third-party managed security services, malware protection, and network security controls. We also maintain a cyber insurance policy that provides coverage for certain costs and liabilities associated with cybersecurity incidents, including data breaches and network interruptions; however, such insurance may not be sufficient to cover all losses in every circumstance.

companyName: DevvStream Corp.

ticker: DEVS


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents and expenses incurred from cybersecurity incidents were immaterial (including penalties and settlements, of which there were none). For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "Risks related to our intellectual property, cybersecurity, information technology and data management practices", which are incorporated by reference into this Item 1C.

companyName: General Motors Co

ticker: GM


text: We have implemented information security policies and standards across the company. We provide ongoing cybersecurity training for employees and conduct employee phishing tests. We maintain business continuity, disaster recovery, and incident management plans. We conduct tabletop exercises and penetration testing. We use third-party security tools that help prevent, identify, investigate and resolve vulnerabilities in our systems and products. Certain Ventus offerings are PCI DSS 4.0 compliant, which requires auditing by an external auditor. We also have processes to oversee and identify cybersecurity threat risks associated with our use of new third-party service providers, including those who have access to our customer and employee data or our systems.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: While we believe we have implemented robust security procedures and controls to mitigate cybersecurity threats, we cannot be certain that these measures will be successful. The threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Although to date the Company has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Company's systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: c.ensuring that adequate resources are dedicated to cybersecurity risk management; and d.confirming that awareness of cybersecurity risk management activities is evident throughout the organization.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: The Audit Committee reports to our board of directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments, on a quarterly basis, or more frequently as needed. The board of directors also receives updates from management on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework.

companyName: Zeo Energy Corp.

ticker: ZEO


text: Our finance leadership team, led by our chief financial officer, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our finance leadership team has experience selecting, deploying and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and are designed to help protect our information assets and operations from internal and external cyber threats and to protect the information of employees, customers, vendors, and other individuals, such as subjects enrolled in our clinical trials, from unauthorized access or attack, as well as secure our networks and systems. We have designed our processes based on, and periodically assess our processes against, the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2, or the NIST Framework. This does not imply that we meet any particular technical standards, specifications, or requirements of the NIST Framework, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our processes for assessing, identifying and managing cybersecurity risks include physical, procedural and technical safeguards, a cybersecurity incident response plan, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including computer security firms, to assist us with the identification, verification, and validation of cybersecurity risks, and to support mitigation efforts if necessary. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: OCULAR THERAPEUTIX, INC

ticker: OCUL


text: Information security managers carry broad manager level cyber security certifications, and the technical teams carry relevant specific technical certifications related to both Information Technology and Operational Technology security.

companyName: Noble Corp plc

ticker: NE


text: To date, the Company is not aware of any cybersecurity threats, including any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, as discussed under the heading, "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our customer's patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A, "Risk Factors," the Company remains subject to evolving cybersecurity risks that could have adverse impacts.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: We have established an Enterprise Risk Committee, which is led by our Chief Risk Officer and includes our executive management team, our Chief Cybersecurity and Technology Risk Officer, our Chief Ethics and Compliance Officer, and our Head of Internal Audit, for the purpose of monitoring the Company's identification, assessment, mitigation and management of enterprise risks, including cybersecurity risks. Our Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer and Chief Ethics and Compliance Officer each report to the Enterprise Risk Committee on relevant cyber and data risks, controls, and progress against action plans on at least a quarterly basis, and work in coordination with cross-functional teams to oversee our information security strategy and work collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents globally when they arise.

companyName: Dun & Bradstreet Holdings, Inc.


text: Board of Directors The Board of Directors has direct responsibility for the risk profile of the Company, as defined by the requirements of the shareholders. Inherently included in the Company's risk profile is the risk of cybersecurity threats. The Audit Committee of the Board of Directors has been delegated the responsibility to oversee the management of risks for the Company, including those pertaining to cybersecurity. The Audit Committee is responsible for: • Providing oversight of risks, including but not limited to finance, operations, information technology and information security, privacy, legal and regulatory. • Meeting periodically with management to review the Company's significant risks and the steps management has taken to monitor, control or mitigate such risks. • Reviewing required disclosures pertaining to risks.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Incident Response Plan. The Company has established and maintains a comprehensive incident response plan that addresses the Company's response to a cybersecurity incident.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: The management team delegates responsibility for assessing and managing our cybersecurity risks to the CISO. The CISO has primary responsibility for our overall cybersecurity risk management and supervises both our internal cybersecurity personnel and any external cybersecurity consultants. The CISO has over two decades of security work that includes work for large global enterprises, managing global security teams, and establishing and running security programs for both conventional and high-tech companies, including publicly traded and regulated companies. The CISO reports to an internal security team periodically regarding current security posture, risk, and trending security incidents and threats relevant to the Company. The security team comprises key management personnel, department heads, and business unit leaders.

companyName: Lemonade, Inc.

ticker: LMND


text: Monitoring and ensuring Payment Card Industry Data Security Standard (PCI-DSS) compliance where required across the enterprise; and Conduct and supervision of penetration testing.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: The Company's Audit and Valuation Committee oversees the Company's cybersecurity risk management process. The Audit and Valuation Committee has adopted a charter that provides that the Audit and Valuation Committee must periodically review and discuss with the Company's management team the Company's guidelines and policies with respect to risk assessment and risk management of cybersecurity and other risk exposures relevant to the Company's computerized information system controls and security. The Audit and Valuation Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks. The Audit and Valuation Committee will report to the Board on the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit and Valuation Committee deems appropriate.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: Governance of the information security program begins with the IT Risk Governance Subcommittee, a management level subcommittee, whose objective is to protect the integrity, security, safety and resiliency of corporate information systems and assets. Together, our CISO leads the Company's IT Risk Governance Committee. The IT Risk Governance Committee meets regularly to review the development of the program and develop recommendations and provides regular reports to management, and, ultimately, the Board Risk Committee through the CISO.

companyName: FIRST BANCSHARES INC /MS/


text: To date, we have no t experienced any material cybersecurity incidents. We continue to monitor evolving threats and adjust our practices as necessary to help protect our systems, data, and operations.

companyName: Paramount Gold Nevada Corp.

ticker: PZG


text: We also conduct tabletop exercises annually, to simulate responses to cybersecurity incidents and ensure accuracy and continuous improvement of the incident response plan. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the Company and form detection, mitigation and remediation strategies.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Our Chief Information Officer ("CIO") is responsible for assessing and managing cybersecurity risks. The CIO is supported by the Senior Director of IT Governance, Security, and Service Delivery and the Senior Director of Global Infrastructure, and Senior Information Security Architect, who manage our day-to-day cybersecurity-related matters and keep abreast of cybersecurity news, events and incidents through regular course monitoring and updates. Our CIO has over 12 years of professional experience in various roles involving managing information security, developing cybersecurity strategy, implementing cybersecurity programs, and managing multiple industry and regulatory compliance environments. Our CIO also holds a certificate in Cyber-Risk Oversight issued by the National Association of Corporate Directors. Our Senior Director of IT Governance, Security, and Service Delivery has over 15 years of professional experience in various roles involving managing information security, developing cybersecurity strategy, implementing cybersecurity programs, and managing industry and regulatory compliance environments. Our Senior Information Security Architect has over 20 years of professional experience designing secure architecture, conducting threat and risk assessments, incident response, cyber forensics, and teaching college and university level cybersecurity program courses. Our Senior Information Security Architect also holds a diverse set of certifications, including CISSP, CISCO Security +, CISA, CEH, CompTIA Sec +, and others.

companyName: Sotera Health Co

ticker: SHC


text: Under the Cybersecurity Program, systems and networks under Company control are monitored for anomalies using various security tools that identify potential cybersecurity threats and alert the Company's internal cybersecurity team to suspicious activity. If a potential cybersecurity incident is identified, it is investigated by the Company's internal cybersecurity team (including the Company's Chief Information Security Officer (the "CISO")) to assess whether a cybersecurity incident has occurred, its severity and the risk involved, in accordance with internal processes and procedures and the Company's incident response plan. The CISO is responsible for management of these cybersecurity processes, and reports to the Company's Chief Information Officer (the "CIO"), who reports to the Company's Chief Technology Officer (the "CTO"). The CISO and CIO will receive input from, and coordinate with, the CTO and the Company's Chief Privacy Officer (the "CPO"), as necessary. If a cybersecurity incident is discovered, it must be reported by the CIO and the CISO to the Company's senior management, including the CTO, the Company's Chief Financial Officer and the Company's General Counsel for further assessment regarding scope, mitigation, remediation and disclosure obligations, as applicable. T he audit committee of our board of directors oversees the Company's information security and cybersecurity risks, compliance and protections, and receives quarterly cybersecurity updates from the CISO and CIO (with input from the CTO and the CPO, as appropriate) and results of the Company's incident response plan testing at least annually.

companyName: OUTFRONT Media Inc.

ticker: OUT


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems that could adversely impact our business in the event of a cybersecurity incident.

companyName: VERACYTE, INC.

ticker: VCYT


text: As a community bank, we rely heavily on information technology and telecommunications systems to conduct our business activities, such as processing transactions, maintaining records, communicating with customers and vendors, and providing online and mobile banking services. These systems are subject to various cybersecurity threats, such as unauthorized access, hacking, phishing, malware, ransomware, denial-of-service attacks, and other malicious or criminal activities, that could compromise the confidentiality, integrity, or availability of our systems, data, or customer information. Cybersecurity threats may originate from external sources, such as cybercriminals, hackers, terrorists, or foreign governments, or from internal sources, such as employees, contractors, or vendors. Cybersecurity threats may also target our third-party service providers, such as core processors, cloud providers, or payment processors, whose systems and data are interconnected with ours.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Our CIO has over 20 years of professional experience specializing in business transformation, change management, executive leadership, and IT strategy, and has worked with technology security, banking and media companies. Our head of Information Security also brings over 20 years of security, privacy, and compliance experience from public and private sector roles of which he spent the last ten years specifically leading security programs at late-stage SaaS companies.

companyName: ON24 INC.

ticker: ONTF


text: We rely on Information Technology systems and infrastructure for many of our business and internal processes. Some of these systems and infrastructure are managed by third-party service providers who are not under our direct control. In order to mitigate material risks from our critical Finance-related third-party service providers, we annually review their SOC1 reports for any noted material incidents and risks.

companyName: Third Harmonic Bio, Inc.


text: The Company's risk management program includes procedures, systems, and processes for assessing, identifying, and managing material risks from cybersecurity threats. Overall, we address cybersecurity risks through the Board of Directors (the "Board") and management oversight and a system of controls and procedures designed to protect the confidentiality, integrity, and availability of the Company's information assets. The Company employs a comprehensive system of monitoring, detection, internal reporting, and prompt escalation of certain cybersecurity incidents, plans for incident response and recovery, technical safeguards, third-party risk management, and mandatory training and awareness campaigns.

companyName: MANITOWOC CO INC

ticker: MTW


text: The Company has established an information security culture that promotes and communicates the role of all employees in protecting the Company's information and systems. The program defines information security responsibilities and accountability throughout the organization. We communicate these responsibilities to employees upon hiring and regularly throughout employment.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: As of the date of this Form 10-K, Innventure has not identified risks as a result of prior cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, Innventure's operations, business strategy, results of operations, or financial condition. Innventure faces certain ongoing risks from cybersecurity threats and interruptions that, if realized, are reasonably likely to have a material adverse effect on Innventure's business, financial condition, results of operation, and prospects. See "Risk Factors—Cyber-attacks or a failure in Innventure's information technology and data security infrastructure could adversely affect Innventure's business and operations."

companyName: Innventure, Inc.

ticker: INV


text: In addition, we undergo several compliance audits annually, which include a SOX compliance audit, and a SOC1 audit. Our approach to managing compliance-related risks includes maintaining a data loss prevention program, centralized compliance management, an identity management platform, ongoing Managed Security monitoring, threat and vulnerability monitoring, and information security risk insurance.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. Ensuring that changes to security configurations are documented, approved, and tested. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks. Conducting subsequent penetration testing and vulnerability assessments, as warranted.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Company's cybersecurity approach comprises a holistic strategy that includes comprehensive security policies and standards, a robust security awareness and education program, and the implementation of advanced and layered defenses. Our cybersecurity program is aligned with generally accepted principles and practices for securing information systems and data. The program is designed to comply with all applicable laws and regulations and uses guidance from many best practices. Our cybersecurity program, policies and controls align to those of the National Institute of Standards and Technology's Cybersecurity Framework.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: Cybersecurity risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and policies to align with the latest in industry best practices and an ever-changing threat landscape.

companyName: Phunware, Inc.

ticker: PHUN


text: As part of our ongoing information security program, Western Digital utilizes periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels must navigate complex incident scenarios to help determine our level of preparedness for various cybersecurity incidents.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: The Innovation and Cyber Committee reviews our cybersecurity risk across the enterprise at least annually, including IT, supply chain and products and our cybersecurity strategy framework and operational posture. The Innovation and Cyber Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements. The Innovation and Cyber Committee reports its activities to the full Board on a regular basis and makes such recommendations to the Board and management with respect to risks from cybersecurity threats and other matters as it deems necessary or appropriate.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: We have processes and a risk-based approach that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. The CISO reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. This review aids in the identification of material breaches at other companies, including our third-party service providers. The CISO also discusses trends in cyber risks and our strategy to defend our information against cybersecurity incidents with our Audit Committee and executive leadership team on a regular basis, in addition to the annual review and discussion with the full board. In addition to our dedicated information security and technology teams monitoring our daily operations, we engage independent third-party cybersecurity providers for managed systems security, endpoint detection and response, and threat and vulnerability management. Regular communication with these providers aids in the identification and remediation of potential threats, and we regularly review our relationships with and services from these providers against industry standards and evolving cybersecurity threats.

companyName: Primo Water Corp /CN/


text: The incident response plan provides guidance in identifying, assessing, investigating, remediating, and reporting any confirmed or suspected: (i) compromise of physical, network or system security; (ii) unauthorized access or acquisition of personal information or proprietary information; or (iii) material noncompliance with Company information privacy and security policies and procedures. The plan and associated processes have flexibility to ensure a tailored response based on the circumstances of the incident.

companyName: Turtle Beach Corp

ticker: TBCH


text: Cybersecurity Program Overview Our Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Our Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: We have established processes to assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. In an effort to protect our information systems from cybersecurity threats, we have implemented information security and incident response policies as well as operating procedures.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I — Item 1A. Risk Factors," specifically the risk titled "We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: LiveOne, Inc.

ticker: LVO


text: PMI follows a risk evaluation process for issues identified through internal audits, security assessments, third-party cybersecurity risk assessments, or self-assessment disclosures, and resulting information technology risks are recorded for risk remediation, transfer, avoidance, or acceptance as appropriate. Some of our information systems are managed by specialist third-party service providers, and we work with internal specialists to protect systems and data from unauthorized access and other cybersecurity threats.

companyName: Philip Morris International Inc.

ticker: PM


text: Related to Cybersecurity Risks Our President meets regularly with representatives from our external partners to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: We maintain cybersecurity insurance to protect our organization from potential financial losses due to cyber incidents, such as data breaches, ransomware attacks, and other cyber-related events. Our cyber insurance policy is a key part of our risk management strategy. However, it is important to note that this coverage may not completely cover all potential losses or liabilities associated with a cybersecurity incident. We regularly review and update our policy to ensure it aligns with evolving risks and industry standards. By having this insurance in place, we are better prepared to manage the financial consequences of any cyber threats we may face.

companyName: POTBELLY CORP

ticker: PBPB