text: We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for our cybersecurity framework. This does not imply that we meet any technical standards, specifications or requirements under the NIST CSF, only that we use the NIST CSF as a framework to help us identify, assess and manage cybersecurity risks related to our business. Our policies for overall general information technology controls are also influenced by the Control Objectives for Information and Related Technologies, which align with the NIST CST.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our Cybersecurity Committee members and external experts meet quarterly, at a minimum, with the primary purpose of identifying emerging company risks and related solutions, and evaluating the progress of previously-identified risk mitigation activities.

companyName: FULL HOUSE RESORTS INC

ticker: FLL

secItem: Item 1C


text: The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company's use of information and technology assets and demonstrate effective governance of cybersecurity risk. The CSC is chaired by the CISO, and includes the Company's Chief Financial Officer, General Counsel, Chief Information Officer, and other senior representatives from the Company's business segments and functions. The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts. Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.

companyName: Johnson Controls International plc

ticker: JCI


text: We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Role of the Board of Directors The Board of Directors has delegated to the audit committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The audit committee receives quarterly reports and updates from our Chief Information Officer and Executive Vice President of IT and Information Security with respect to cybersecurity risk management. Such reports cover the Company's information security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit and Risk Committee. The Audit and Risk Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.

companyName: PARSONS CORP

ticker: PSN


text: At the Group level, CRH conducts a semi-annual bottom-up risk assessment focused on CRH's operating subsidiaries and business units, including cybersecurity-related risks, which evaluates the impact and likelihood of the identified cyber risks and the effectiveness of existing security measures, policies, and procedures. CRH also requires that each operating subsidiaries completes a self-assessment regarding its cyber controls and risk, including user awareness training, email security protection, multi-factor authentication, system patch management, identity management, network segregation, antivirus and web protections, asset inventory, privileged access management, logging, monitoring, and incident response capabilities. As described further below under "Cybersecurity Governance", CRH's Board and senior management receive regular briefings on cybersecurity risks facing CRH and are closely involved in identifying cybersecurity risks, developing CRH's plan for managing such risks, and continuously refining CRH's cyber defenses in response to the information gathered through the above-mentioned risk assessments.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Notwithstanding the focus Premier places on cybersecurity, Premier may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: PREMIER FINANCIAL CORP


text: We have experienced two separate cyber events. First, in December 2021, we experienced a targeted cyber-attack, leading to a global shutdown of our connectivity, operational, and accounting systems to protect our infrastructure. Although our operations systems were eventually restored, this event caused significant disruption to our operations for approximately two weeks, temporarily impacting our ability to manage freight shipments, customs brokerage functions, and distribution activities. Next, in March 2024, our Canadian subsidiary experienced a targeted cybersecurity breach. This attack was identified by our end point protection software and our third-party monitoring partner. As per our response process, we initiated a shutdown of our Canadian infrastructure and engaged our incident response team. The operations systems were restored and approved to return to service within one week. While we continue to learn from these incidents, we do not anticipate further material adverse impacts from them on our business. Following the attacks, we enhanced our security program with additional tools and strengthened measures for improved system and network monitoring.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Our business depends on information technology systems and networks, which we protect from cyber threats that could harm our data, operations, and reputation. We have invested in security measures designed to safeguard the data of our customers and employees, prevent, detect, and respond to cyberattacks, and comply with data privacy requirements.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: To operate our business, we utilize certain service providers to perform a variety of functions, such as professional services, data center facilities and other functions. Our processes are designed to address cybersecurity threat risks associated with our use of service providers, including those in our supply chain or who have access to our customer and employee data or our information systems. Certain risks associated with our use of service providers are included within our enterprise risk management assessment program, as well as our processes designed to identify, assess and manage cybersecurity-specific risks, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our service providers. We perform diligence on certain service providers that have access to our systems, data or facilities that house such systems or data. This diligence may include a review of the service providers' internal and/or external security audits and certifications. Additionally, we may impose specific cybersecurity obligations on certain service providers.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.

companyName: Invesco Commercial Real Estate Finance Trust, Inc.


text: Under the leadership of the CIO, the ITSC serves to improve the effectiveness of information technology at the Bank and ensure alignment with the Bank's strategic business plan and statement of risk appetite. Composition of the ITSC consists of senior management from the business areas. The virtual CISO is a non-voting member of the ITSC. Meetings occur at least bi-annually. The ITSC is tasked with reviewing the Bank's technology, information security, business continuity, digital initiatives, vendor management, and data management strategic direction and providing feedback to management.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Cyber Risk Management and Strategy At BJ's, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that our members share with us. We have implemented a cybersecurity program in accordance with our risk profile and business that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), International Organization for Standardization ("ISO") 27001 and Payment Card Industry Data Security Standard ("PCI DSS") standards.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: We have integrated the process of cybersecurity risk management, including oversight of the ISMS, into our broader risk management framework. The Board has broad oversight of risk management related to us and our business while delegating certain specific risk oversight responsibilities to its committees. The Board oversees our risk management activities through a combination of processes, including direct engagement with management. The Board has determined that the Audit and Risk Committee shall review our compliance with legal and regulatory requirements as well as the effectiveness of our risk management processes. As part of this oversight, the Audit and Risk Committee reviews the guidelines, policies, and practices that govern how senior management handles our exposure to cyber- and privacy-related risks.

companyName: Bumble Inc.

ticker: BMBL


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with various applicable security and/or technical requirements and best practices, including those established by the National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as a framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. Our board of directors oversees the Enterprise Risk Management (ERM) Program, the Enterprise Security Program and Information Security through policies and principles including the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The board of directors oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.

companyName: Federal Home Loan Bank of Topeka


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

companyName: Lightstone Value Plus REIT V, Inc.


text: We perform risk assessments on critical third-party service providers, software and other tools used in the Company's operations that may have the potential to create cybersecurity threats to our business.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, and processes are being integrated into the Company's ERM program and based on recognized frameworks and industry standards, including the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of Company and customer systems, information, and products.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: The Senior Information Security Officer (ISO), along with both the Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program. The Director of IT and Director of Information Services report to the Chief Financial Officer and are responsible for designing and maintaining the company's network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence. The ISO reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities. The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.

companyName: SIERRA BANCORP

ticker: BSRR


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: COHERENT CORP.

ticker: COHR


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Bank's business, financial condition, and results of operations, the Bank does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Bank, including its business strategy, results of operations or financial condition. Accordingly, no matter how well designed or implemented the Bank's controls are, there is a risk that it may not be able to anticipate all zero-day cyber security exploits and vulnerabilities, and it may not be able to implement effective preventive measures against such exploits / vulnerabilities and potentially associated security breaches in a timely manner.

companyName: BCB BANCORP INC

ticker: BCBP


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: To identify, detect and respond to a cybersecurity incident, we conduct proactive cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing, perform incident response capability reviews and exercises, conduct annual employee training, monitor emerging laws and regulations related to data protection and information security (including intellectual property) and implement appropriate changes. The Company has implemented a cybersecurity incident response plan that outlines the Company's process for preparing for a cybersecurity incident, detecting, analyzing, containing, eradicating and recovering from such incident, and provides guidance for post-incident analysis. Additionally, we have established a Cyber Incident Committee that is comprised of leadership across the Company's finance, legal, accounting, internal audit and IT organizations to provide guidance and monitor overall company cybersecurity.

companyName: Westrock Coffee Co

ticker: WEST


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.

companyName: Seritage Growth Properties

ticker: SRG


text: Legal and Regulatory Risks • investigations, claims, disputes, enforcement actions, litigation (including criminal, civil and administrative) and/or other legal proceedings • the improper conduct of employees, agents, subcontractors, suppliers, business partners or joint ventures in which we participate, including the impact on our reputation and our ability to do business • changes in procurement and other laws, SEC, DoD and other rules and regulations, contract terms and practices applicable to our industry, findings by the U.S. government as to our compliance with such requirements, more aggressive enforcement of such requirements and changes in our customers' business practices globally • environmental matters, including climate change, unforeseen environmental costs and government and third party claims • unanticipated changes in our tax provisions or exposure to additional tax liabilities

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Our Board has overall responsibility for risk oversight and has delegated to the audit committee primary enterprise risk oversight responsibility for overseeing the Company's risk assessment and risk management related to cybersecurity. The audit committee of our Board receives periodic updates from our Security and Privacy Council and/or Information Security team concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.

companyName: Akili, Inc.


text: Our risk management process also assesses third party risks. We perform assessments to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers and potential fourth party risks when handling and/or processing our employee, business, or customer data.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: We do not believe that there are currently any known risks from cybersecurity threats that have or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: Employee Training and Awareness: Mandatory ongoing cybersecurity training is provided to all employees to educate them about potential cybersecurity risks. Management fosters a culture of cybersecurity awareness and encourages employees to be proactive in identifying and reporting security issues.

companyName: DallasNews Corp


text: On a periodic basis, the Company engages independent third-party subject matter experts to conduct a cybersecurity maturity assessment based on the National Institute of Standards and Technology framework, focused on risk assessment, global payment card industry audits, and compliance audits to help identify gaps and improve existing processes. In addition, the Company has a cybersecurity risk program that includes policies and procedures around onboarding of third parties, contractual agreement review, risk assessment and ongoing monitoring of high-risk vendors.

companyName: TAPESTRY, INC.

ticker: TPR


text: Our Board's Role in Cybersecurity Oversight Oversight of risk management, including with respect to risks from cybersecurity threats, is the responsibility of our Board, which exercises its oversight responsibilities both directly and through its committees. The Audit Committee of our Board has formal oversight responsibilities established in its committee charter concerning our initiatives and strategies respecting cybersecurity and information technology risks. At least once annually, the heads of our information services and internal audit teams provide a report to the Audit Committee on cybersecurity and information technology risks, as well as our information security operations, structure, framework, various cybersecurity and information technology metrics, our cybersecurity and information security management and improvement efforts, future projects, and our governance and assessments related to cybersecurity and information technology. The chair of the Audit Committee reports to the Board a summary of the information presented by the heads of our information services and internal audit teams during their cybersecurity update. Periodically, the Board also receives reports on such matters directly. As noted above, the IRP also contains notification procedures to the Board.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO/CISO and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: North Haven Private Income Fund A LLC


text: Our CISO is responsible for managing any cybersecurity incidents under the SIRP and coordinating with our senior management. The SIRP includes a process under which senior leaders from our information security, legal and accounting teams will assess the impact and significance of a cybersecurity incident to determine any necessary external notifications or filings. The SIRP also contains parameters regarding the requirements and timing for notifications of certain cybersecurity incidents to our board of directors.

companyName: Repay Holdings Corp

ticker: RPAY


text: We have process, controls and technology infrastructure to maintain, protect, and enhance existing systems and design new systems to keep pace with continuing changes in technology, evolving industry and regulatory standards, and emerging cybersecurity and data security risks.

companyName: HERBALIFE LTD.

ticker: HLF


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on the Trust's service providers, including the Trustee and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor's officers review and report the results of this annual review and any incidents or perceived risks to the Board of Directors.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Over the last three years, we have experienced one known information security breach, in connection with a ransomware incident that occurred in June 2021. Costs incurred related to the information security breach did not have a material adverse effect on our results of operations in the years ended December 31, 2023, 2022, and 2021. However, as cybersecurity incidents continue to increase in scope, complexity, and frequency, we may be unable to prevent a significant incident in the future which may materially impact our results of operations.

companyName: ALLIENT INC

ticker: ALNT


text: Longer term cybersecurity risk management strategic planning is addressed by the Company's management Cybersecurity Committee, which is comprised of the VP FT, the CSA and members from various departments within the Company, including Legal, Operations and Internal Audit. The Cybersecurity Committee meets quarterly to review cybersecurity threats and risks, strategic objectives, and progress on the Company's cybersecurity initiatives.

companyName: SSR MINING INC.

ticker: SSRM


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Members of our board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: NETLIST INC

ticker: NLST


text: The CISO team is supported by a Security Operations team reporting into the Information Technology ("IT") function. This IT team provides engineering and technical expertise. The team is further supported by a 24x7 Security Operations Center ("SOC"). Adtalem has a Cyber Incident Response Plan ("Response Plan") that delineates the requirements of notification, classification, analysis, and communication of cybersecurity incidents based on the identified severity level. The Response Plan includes initial steps to convene a response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and possible disclosure requirements, and consider involving law enforcement. The Response Plan also provides for a lessons learned review to identify improvements that could be made. Adtalem's Legal and Compliance teams also provide incident response support to the CISO and manage cybersecurity-related legal and compliance issues. Processes are in place to escalate cybersecurity incidents promptly so that decisions regarding public disclosure and regulatory reporting can be made by management in a timely manner.

companyName: Covista Inc.

ticker: CVSA


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. Our CISO has cybersecurity expertise from over 18 years of experience in the field of cybersecurity. His background includes extensive experience as CISO at Civeo and previously for a Fortune 500 company. He also oversees our cybersecurity governance programs, assists with testing our compliance with applicable standards, leads our efforts to remediate known risks and leads our employee training program.

companyName: Civeo Corp

ticker: CVEO


text: To date, we have not experienced a material cybersecurity incident and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: HCW Biologics Inc.

ticker: HCWB


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our Company from cyber threats as well as secure our networks and systems. Such processes include safeguards, response plan, and review of our policies and procedures to identify risks. We engage an external party to enhance our cybersecurity oversight.

companyName: Inmune Bio, Inc.

ticker: INMB


text: Our organization's cybersecurity program is informed by industry standards and industry-recognized practices, such as the NIST Cybersecurity Framework, ISO 27001, and CIS Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This helps us align with the specific requirements of diverse regulatory environments and industry benchmarks without compromising on security or efficiency.

companyName: StandardAero, Inc.

ticker: SARO


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives reports from management on our cybersecurity risks, at a minimum annually and as needed. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Incident reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee, CISO and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Audit Committee conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: We use a risk-based approach with respect to our oversight of third-party service providers. As part of our new vendor onboarding process, we assess all new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and all new third-party service providers are reviewed and approved by our Finance and Legal departments. Foreign vendors are evaluated separately for compliance with the Foreign Corrupt Practices Act. Our contracts with third-party service provides include appropriate data security and privacy terms. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor's audit firm which provides detailed information and assurance about a service organization's security, availability, processing integrity, confidentiality and privacy controls, in accordance with Statement on Standards for Attestation Engagements No. 18.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities. Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents.

companyName: RBB Bancorp

ticker: RBB


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the quality and effectiveness of the control and enterprise risk management processes of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives reports and engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and reasonably manage these risks, including those that may result from material cybersecurity threats. The Audit Committee also receives reports on material cybersecurity and data privacy incidents (if any), which would include plans to mitigate and respond to such incidents, and status on key information security initiatives. These discussions include the Company's enterprise risk assessment and risk management policies.

companyName: Gentherm Inc

ticker: THRM


text: A detailed Cybersecurity Incident Response Plan ("CIRP") is maintained and practiced at least annually. The CIRP provides organizational and operational structures, processes, and procedures designed to identify key incident response stakeholders, and allow our personnel to properly respond to material incidents that may affect the function and security of information technology assets, information resources, and business operations. We have a designated incident response team in place to carry out the CIRP, which consists of core members from our information technology group and an extended team consisting of key personnel from areas such as Legal, Finance, Human Resources and Public Relations that we can engage as deemed necessary, as well as third-party experts.

companyName: DAVEY TREE EXPERT CO


text: The audit committee is responsible for oversight of our cyber risk management program. The day-to-day management of the cyber program is directed by the Director of IT under the direction of the Chief Financial Officer. Currently, the Director of IT reports to the Chief Financial Officer and provides periodic updates to the Chief Financial Officer on cyber matters.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: Roivant and the Vants undergo periodic internal compliance audits and external reviews to evaluate our controls, including cybersecurity controls. Additionally, a majority of our information technology systems are built on services provided by third parties. In an effort to minimize third-party risk, we have established a process designed to assess the cybersecurity practices of third-party suppliers and related risks, including through review of relevant supplier certifications and cybersecurity procedures and responses to standardized information-gathering questionnaires, as we deem applicable and appropriate. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from any such compromise or failure.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The response plan includes (1) detection, (2) analysis, which may include timely notice to our management and audit committee chair, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. Annually, we execute a tabletop exercise to test our incident response plan documentation and process execution. We also maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents. It is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.

companyName: Arq, Inc.

ticker: ARQ


text: Our commitment to cybersecurity includes a total life cycle approach to protecting BD products, manufacturing and distribution OT, enterprise IT and BD data. Using various tools and techniques, we proactively monitor for suspicious activity and perform risk assessments (including independent third-party risk assessments), penetration testing and vulnerability scanning to identify potential threats and vulnerabilities. We also collaborate with government and industry leaders to gather and share cybersecurity threat intelligence. We provide mandatory annual cybersecurity awareness training for our 70,000+ associates, and we send phishing simulation emails monthly to all associates who use a BD email address and an assigned computing device. We also use tools to monitor unintentional sharing of personal, confidential and proprietary information. Our cybersecurity risk management program includes a documented incident response and critical incident management plan to identify, assess and manage the potential impact of cybersecurity threats or vulnerabilities and prioritize risk mitigation and/or remediation measures to safeguard BD products, manufacturing and distribution OT, enterprise IT and BD data.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Management's Role in Cybersecurity Risk Management The Company relies on the Investment Adviser and IT MSP to assess and manage material risks from cybersecurity threats. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents, if any, impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.

companyName: Brightwood Capital Corp I


text: For further details on the cybersecurity risks we face, refer to Part I, Item 1.A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: IREN Ltd

ticker: IREN


text: We have implemented processes designed to mitigate risks related to data breaches or other security incidents originating from third parties. With our vendors, we conduct security assessments of key third-party providers before engagement and maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.

companyName: WORLD KINECT CORP

ticker: WKC


text: In addition, the Company's Board is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board, with support from the Company's management and third party cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. The Board reviews and approves an information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy and business continuity planning policy on an annual basis. All the aforementioned policies are developed and implemented by management of the Company. To carry out their duties, the Board receives updates from the Information Technology Steering Committee regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity.

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Despite our work to identify and address cybersecurity risks, we experience threats to our data and systems. We have experienced cybersecurity incidents in the past, including breaches of our data and systems. To date, none of those cybersecurity incidents has resulted in a material impact on our business strategy, results of operations or financial condition. However, the impacts of cybersecurity incidents in the future could be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents are inevitable, and disruptions in our information technology systems or a compromise of security with respect to those systems could adversely affect us" in Item 1A- Risk Factors in this Annual Report.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: During the last three years, the Company has not experienced a material security breach and, as a result, the Company has no t incurred any material expenses from such a breach. Furthermore, during such time, the Company has not been penalized or paid any amount under any information security breach settlement.

companyName: OneMeta Inc.

ticker: ONEI


text: The Company's Information Security Officer (ISO), James Hinks, leads our cybersecurity program and oversees the Company's Security Operations Team (SOC), supporting our security functions of identifying, preventing, detecting, responding, and recovering. The SOC team comprises personnel with extensive experience in information technology across the private and public sectors. Mr. Hinks holds multiple security accreditations and 25 years of experience in cybersecurity, software development, systems, networking, and other technology-related roles within public and private industries, with 15 years in IT leadership roles. Mr. Hinks has been employed with the Company since 2019, overseeing information security, disaster recovery, vendor management, and physical security.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In 2024, the Company has continued to make strategic investments in both its technical and organizational measures to further enhance its security capabilities and planning for detecting, preventing, and responding to cybersecurity attacks. Risks from cybersecurity threats that are reasonably likely to materially affect the Company, its business strategy and results of operations or financial condition, include (but are not limited to): data loss; a disruption to our operations; a compromise or corruption of confidential or proprietary information; damage to our employee and business relationships and reputation; increased burden of regulatory compliance; and/or litigation and liability. See our related risk factors in "Item 1A. Risk Factors" for more information about the Company's risks from cybersecurity threats and how such threats may impact the Company's business, operations, and financial results.

companyName: Wingstop Inc.

ticker: WING


text: The Audit Committee of the Board of Directors oversees Orchestra's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Members of the Cyber Risk Committee brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Orchestra's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes reporting cybersecurity incidents and updates on Orchestra's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by Orchestra's Board of Directors, at least annually, as part of the Company's corporate risk oversight processes.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: We recognize that our cybersecurity risk profile extends beyond our organization. As such, we strive to manage cybersecurity risks associated with our third-party business partners and external users of our systems. Our third-party business partner risk management program is built upon, informed by, and responsive to industry best practices. This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners. Specifically, to evaluate third- party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.

companyName: Cencora, Inc.

ticker: COR


text: Assessing, identifying, monitoring, and managing cybersecurity-related risks are being included in our overall risk management processes. Cybersecurity-related risks are included in the population of risks that are evaluated to assess top risks to the Company on an annual basis. To the extent a heightened cybersecurity related risk is identified, risk owners will be assigned to develop risk mitigation plans, which are then tracked to completion. The annual risk assessment will be presented to the Board of Directors.

companyName: RideNow Group, Inc.

ticker: RDNW


text: Third-Party Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors, service providers and other users of the Company's systems.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: On an ongoing basis, management assesses the cybersecurity risks of Cannae and aligns its procedures and its audit plan with the identified and addressable risks. The underlying controls of the cyber risk management program are based on the recognized standards as outlined in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We utilize a third party to manage our IT network and processes and our ERM personnel work directly with the provider on all aspects of the Company's IT infrastructure and cybersecurity risks. Risks are evaluated over various timeframes; however, the focus of management's risk assessment is on risks to the long-term solvency and sustainability of the ongoing operations of Cannae. Risks with the potential for an adverse impact to the Company in the near term are prioritized to the extent they present a material risk to the financial viability of the Company.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: We maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third-party vendors. Third-party vendors that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies, are evaluated to assess their performance across several domains, including data security and operations management. We seek to maintain effective communication with our third-party vendors to facilitate timely notification of cybersecurity incidents that might impact the Company.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: The Company uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Management Enterprise Risk Committee has established risk management guidelines for third-party vendors. Through the Vendor Management Committee, the Company conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Company's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed periodically. The Company cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Company may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Company shares with such providers.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: We have invested in relevant tools and technologies to protect our data and business partners. Our Security Operations Team continuously monitors risks specific to our industry. We also leverage third-party assessors, consultants, and advisors to enhance our cybersecurity risk assessment and mitigation efforts. To foster a security-conscious culture, we have implemented a cybersecurity awareness program that educates employees on identifying and reporting threats. We conduct periodic phishing campaigns and training sessions to equip employees with the necessary skills to manage and defend against prevalent cybersecurity risks. Additionally, employees in specialized IT roles receive targeted training, including tabletop exercises, among other training.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: HHH's Board of Directors' Technology Committee governs and oversees HHH's cybersecurity program. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the HHH Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform HHH's Board of Directors on important matters. Furthermore, HHH's Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.

companyName: Howard Hughes Corp


text: Our information security program is managed by a dedicated Chief Information Security Officer (CISO), who reports to our Chief Technology Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our foundational security engineering, governance risk and compliance, product security and security operations teams report into our CISO and provide regular updates on significant or potentially significant threats and incidents. Our CISO has over 20 years of experience in information security, serving in roles of increasing responsibility within several public companies including companies in the cybersecurity and software fields. In addition, our Deputy CISO has nearly 20 years of experience serving in information security roles in healthcare and technology companies.

companyName: BILL Holdings, Inc.

ticker: BILL


text: Our finance leadership team, led by our chief financial officer, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our finance leadership team has experience selecting, deploying and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. We also rely on threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third parties that may lead to a service disruption or an adverse cybersecurity incident. This includes processes for performing third-party risk ratings and data classification mapping of current and ongoing vendors.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our capabilities, processes, and other security measures also include, without limitation: • Endpoint Detection and Response software, which monitors for malicious activities on external-facing endpoints (computers, servers, etc.). • Managed Detection and Response partnership with a third-party security firm, which monitors these endpoints on a continual basis. • Cloud monitoring, running on primary public and private cloud environments. • Disaster recovery and incident response plans, including a ransomware response plan. • Training for all personnel with access to digital assets.

companyName: AIR T INC

ticker: AIRT


text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents at Sandisk. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.

companyName: Sandisk Corp

ticker: SNDK


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more detailed information about the cybersecurity risks we face, please see Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including Risks Related to Privacy, Data Protection and Cybersecurity: "A breach of our security measures or unauthorized access to proprietary and confidential data, or a perception that any security breach or other incident has occurred, may result in our platform or products being perceived as not secure, lower customer use or stoppage of use of our products, and significant liabilities."

companyName: JFrog Ltd

ticker: FROG


text: Together with the MSP, we engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The MSP regularly assesses our cybersecurity measures, including information security maturity, and regularly reviews our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we will adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Our CISO is primarily responsible for assessing, monitoring and managing our cybersecurity risks and has worked in the cybersecurity field since 1996. His background includes both the public and private sectors. Our CISO has served in his position with the Company since 2020 and has built out a comprehensive security program for the Company by adding cybersecurity capabilities and aligning our cybersecurity systems to leading industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our cybersecurity training program for associates.

companyName: Integer Holdings Corp

ticker: ITGR


text: Our Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: The combined expertise of the Bank's chief information officer and the chief information security officer in cybersecurity include graduation in Computer Science, Certification in Risk and Information Systems Control (CRISC), Certification in Information Systems Security Professional (CISSP), and Certification in Information Systems Auditor (CISA), along with decades of experience in computer science, information and records security, business continuity, technology governance and compliance, technology risk services, cyber risk assessments, security operations monitoring and response, incident response, security strategy and architecture, awareness training, threat intelligence, identity and access management, vulnerability and penetration testing, maturity assessment, impact analysis, disaster events, recovery response, business resiliency, third party systems due diligence, deep knowledge of software systems and platforms, implementation methodologies, and various technology systems servicing internal and external customers.

companyName: Federal Home Loan Bank of Atlanta


text: At the management level, we have established two committees that are directly involved in managing and responding to cybersecurity risks and incidents: the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee. The Enterprise Risk Management Committee is responsible for assessing enterprise risk and overseeing our enterprise risk management programs, including the cybersecurity risk management programs described above. The Cybersecurity Disclosure Committee is a subcommittee of our Disclosure Committee and is responsible for assessing the materiality of identified cybersecurity incidents resulting from our monitoring programs described above and informing the Chair of the Audit Committee, the Audit Committee, or the Board of Directors, as appropriate. The CISO has responsibility for notifying the CAO and the Cybersecurity Disclosure Committee of potentially material cybersecurity incidents based on an established policy and risk assessment matrix that incorporates an evaluation of quantitative and qualitative factors such as potential impact on results of operations and financial condition, compliance with laws and regulations, and impact on key stakeholders such as employees and business partners. The CISO has over fifteen years of cybersecurity risk management experience and has served the Company for over twenty years in various roles involving managing information technology, security and compliance functions, including developing key enterprise capabilities such as security engineering and strategies on information security risk management.

companyName: TRIUMPH GROUP INC


text: We have established processes and systems to identify and mitigate information security risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain cyber risk insurance coverage commensurate for an institution of our size and complexity.

companyName: Kearny Financial Corp.

ticker: KRNY


text: Certain of the numerous tools and processes that we use to assess, identify and manage material risks include, without limitation: • Automated third-party tools to screen and block malicious content • Dedicated IT security staff who review threats in real time and escalate issues as needed • Regular security tests and audits performed by internal and external parties • Ongoing security training for all employees Our Chief Information Officer ("CIO"), Bryant Saxon, oversees our cybersecurity program and dedicated security resources. Mr. Saxon has over 15 years of direct cybersecurity experience in Chief Information Officer and other key leadership roles in the healthcare industry. His experience includes HIPAA compliance, systems design, security audits, and incident response.

companyName: Pennant Group, Inc.

ticker: PNTG


text: Impact of Risks from Cybersecurity Threats — The energy sector's growing reliance on information and operational technology to manage critical business functions has significantly increased the exposure to cybersecurity threats. The rising frequency and sophistication of cyber incidents, whether resulting from deliberate attacks or accidental breaches, pose substantial risks to the energy industry. As these threats continue to evolve, effectively preventing, detecting, mitigating, and responding to cyber incidents has become an ongoing and increasingly complex challenge. Regulatory compliance adds another layer of complexity, particularly as cybersecurity reporting and disclosure requirements continue to evolve. These regulations require prompt and detailed disclosures of material cyber incidents, demanding significant resources and well-structured internal processes to maintain compliance. Failure to meet these obligations could lead to legal penalties, heightened regulatory oversight, and reputational harm. Additionally, the constantly shifting regulatory landscape may introduce overlapping or conflicting requirements, further complicating compliance efforts. To minimize potential risks, it is essential to closely monitor these developments and incorporate them into our cybersecurity and regulatory compliance strategies.

companyName: TALOS ENERGY INC.

ticker: TALO


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and there can be no assurance that our cybersecurity risk management policies and procedures will be fully implemented, complied with or successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors- Legal and Regulatory Risks- If our efforts to protect the security of personal information about our customers and consumers are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cybersecurity breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation and our reputation could suffer."

companyName: Vista Outdoor Inc.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report, including the risk factors entitled "We may experience disruptions and delays or incur financial damages as a result of system failures or security breaches or incidents" and "If we fail to comply with applicable U.S. and foreign privacy and data protection laws and regulations, we may be subject to liabilities that adversely affect our business, operations and financial performance".

companyName: Allakos Inc.


text: Our management team oversees the efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; as well as providing ongoing cybersecurity awareness training for our employees including management.

companyName: Consolidated Communications Holdings, Inc.


text: Our Board of Directors administers its cybersecurity risk oversight function through its Audit Committee. The Audit Committee is charged with reviewing our cybersecurity and other information technology risks, controls, and procedures, including our plan to mitigate cybersecurity risks and respond to data or cybersecurity incidents. The Audit Committee is also charged with reviewing with management cybersecurity issues that could affect the adequacy of our internal controls. At least annually, the Audit Committee meets directly with the CSO and the executive leadership team and receives a report on our cybersecurity program, posture, risks and other matters. At least annually, we conduct an organization-wide ERM process to evaluate key risks in different areas of the business. Among those risks, cybersecurity risks are identified, and scores representing the potential likelihood and severity of each risk are determined. The executive leadership team and Audit Committee receive a direct report of the ERM program findings, including these cybersecurity risks. Third-party assessors, consultants, counsel or other parties also participate in Audit Committee discussions as needed.

companyName: GRAIL, Inc.

ticker: GRAL


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Risk Officer, to manage the risk assessment and mitigation process. Our Chief Information Security Officer works closely with a team of cybersecurity professionals with extensive experience and expertise in cybersecurity threat assessments and detection, incident response and mitigation.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Our management, including our Chief Operating Officer and Vice President of IT, is responsible for hiring appropriate information security personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and helping prepare for cybersecurity incidents.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: a. Third-Party Risk Management: A process for evaluating and managing the risks associated with our service providers, suppliers, and vendors who access our critical systems and data.

companyName: KALTURA INC

ticker: KLTR


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The Company has implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient data ("Information Systems and Data").

companyName: TerrAscend Corp.

ticker: TSNDF


text: To date, no prior internal cybersecurity incident has materially affected the Company, however, external incidents have increased attention to risk management processes which continually identify and assess threats to the Company's operations with consideration to strategy, financial results, and business resilience.

companyName: EVANS BANCORP INC


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Our Board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the Board, including delegating oversight of specific risks to board committees that align with their functional responsibilities. Our Audit Committee assists the Board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, the company's information security program. Our Audit Committee assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our Chief Information Officer and Director of Information Technology Security periodically attend meetings and provide quarterly cybersecurity updates to the Audit Committee, and as needed, to the Board.

companyName: SelectQuote, Inc.

ticker: SLQT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property loss or theft; fraud; extortion; harm to employees or customers; potential litigation, regulatory investigations or other proceedings, and other legal risks; and reputational risks. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Bakkt, Inc.

ticker: BKKT


text: The Board as a whole also oversees the Company's cybersecurity risks. Our Chief Information Officer updates the Board periodically regarding the actions management is taking to mitigate the Company's cybersecurity risks and enhance the Company's cybersecurity protection. Management routinely evaluates the Company's existing security processes, procedures and systems in order to determine whether additional enhancements are needed to further reduce the likelihood and impact of a future cybersecurity event. Some of the Company's current safeguards include multi-factor authentication for remote access to systems; performing email phishing test campaigns; email spam filtering; restricted internet firewall rules; limiting memory stick and external hard drive use; requiring timely application of security and software patches on servers; antivirus endpoint protection; performing 24-hour/7-day a week network monitoring; and improving our backup and recovery strategy, among others.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: The Company's approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring. The Company works to protect its computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from its defense and monitoring efforts to proactively prevent future attacks. The Company utilizes best-in-class SIEM technologies, data analytics and threat intelligence to detect anomalies and search for cyber threats. The Company's internal cybersecurity team and third-party security services provide comprehensive cyber threat detection and response capabilities and maintain a full-time monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, the Company engages third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats and also periodically uses its Internal Audit function to conduct additional reviews and assessments. • Third-Party Risk Assessments. The Company conducts information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and its standard terms and conditions contain contractual provisions requiring certain security protections. • Training and Awareness. The Company conducts monthly attack simulations across the Company and provide awareness training to our coworkers to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate annually in required training, including spear phishing, malware, access control, and other awareness training. The Company also periodically hosts tabletop exercises with management and other employees to practice rapid cyber incident response; • Supplier Engagement. The Company requires its suppliers to comply with its standard information security terms and conditions as a condition of doing business, and requires them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided. The Company also monitors supplier network access to its networks and systems.

companyName: BOSTON BEER CO INC

ticker: SAM


text: We have developed and implemented a risk-based program focused on cybersecurity measures to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: Use of Third-Party Vendors: Per the Company's Risk Management Guidelines, the Board may, in its discretion, delegate all or a portion of its duties and responsibilities to other committees of the Board. While the Board has not yet engaged assessors, consultants auditors or other third parties to aid in processes related to cybersecurity threats, any such committee will have the resources and authority appropriate to discharge its duties and responsibilities, including the authority to select, retain, terminate, and approve the fees and other retention terms of special or independent counsel, accountants or other experts, as it deems appropriate, without seeking approval of the Board or management. The Company may, from time to time, engage third party vendors to assist in developing, identifying and managing risks.

companyName: Verano Holdings Corp.

ticker: VRNO


text: An incident response plan designed to coordinate the activities that we and our third -party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate incidents, as well as to comply with applicable legal obligations and mitigate any reputational damage;

companyName: FutureFuel Corp.

ticker: FF


text: We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems; intellectual property theft; fraud; violation of data privacy laws and other litigation and legal risk; reputational risk; and risks associated with our use of third-party service providers, as part of our overall risk management system and processes. We address cybersecurity risks and threats through a strategic program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our dedicated cybersecurity team oversees and implements our cybersecurity management program, compliance with applicable legal and third-party data privacy requirements and our incident response and crisis management plans.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: Our Senior Vice President of Operations and Engineering is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the board of directors. Nuwellis leverages 3 rd party IT service provider and specifically their cybersecurity team's expertise.

companyName: Nuwellis, Inc.

ticker: NUWE


text: For a discussion of potential cybersecurity risks affecting the Company, please refer to Part I, Item 1A - "Risk Factors".

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: All new Forrester employees and contractors receive a copy of the Information Security Policy and are required to undergo information security and privacy training both as part of their onboarding and on an annual basis. We currently also maintain cybersecurity insurance covering the company and its subsidiaries.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Our cybersecurity program is led by our CTO, alongside the CEO, and includes but is not limited to: IT security policies and practices, security risk assessment and mitigations, software vulnerability checks and updates, regular access certificate rotations - all designed to protect the privacy and security of the sensitive information and continuation of business.

companyName: NYIAX, INC.


text: Senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks and the creation of appropriate risk management programs and policies to address such risks. Our Director of Information Technology has primary responsibility for managing our cybersecurity program and efforts.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BOX INC

ticker: BOX


text: Information regarding cybersecurity risks may be elevated from information security leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our Information Security Director and third parties as well as part of our enterprise risk management program.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board and our Audit Committee are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, security, and availability of the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Our security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO and senior director of global information technology. Our COO works with our IT department to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to our board of directors for certain cybersecurity incidents.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Operational Security. Access to our systems is restricted to those who require access in accordance with the principle of least privilege. We also conduct background checks for our employees where permitted by local law, require signed confidentiality agreements and acceptable use agreements, and follow termination/access removal processes.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • a documented set of cybersecurity policies and procedures that specifies the manner in which security controls are implemented; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Our Information Security Committee and vCISO, in coordination with management's Risk Committee, work collaboratively to implement a program designed to protect our assets from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, we deploy multidisciplinary teams to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management's Risk Committee when appropriate.

companyName: TRUPANION, INC.

ticker: TRUP


text: Additionally, in connection with our cybersecurity risk management processes, we engage third-party subject matter experts to supplement our dedicated internal resources and to provide independent review of the Tronox-specific threat landscape as well as our mitigation efforts to counter known threats. These activities include: • External penetration testing by certified third parties. • Independent review of the Tronox Information Security Management System (ISMS). • Participating in industry and government cyber incident exercises run by the National Cyber Security Center (UK Security Services). • Utilizing a third party (KnowBe4) for the cybersecurity training and phishing tests described above. • Regularly engaging with statutory auditors in support of specific activities such as SOX 404 audits. • Engaging outside counsel with expertise in the field to advise on critical IT contracts as well as reporting and disclosure requirements. • Membership in a United Kingdom industry cybersecurity group to facilitate intelligence sharing and develop incident response capabilities. • Utilizing a third party vendor for detect and response services who provides 24x7 monitoring and incident response capabilities across the various Tronox technology platforms.

companyName: Tronox Holdings plc

ticker: TROX


text: We continuously evaluate and seek to improve and mature our cybersecurity processes and controls. Our cybersecurity program is regularly assessed through management self-evaluations and ongoing monitoring procedures to evaluate our program effectiveness, including vulnerability management through active discovery, and testing to validate patching and configuration. Additionally, our InfoSec function regularly assesses our program effectiveness through audits of our entities, systems, and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall effectiveness of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency ("DCMA") and Cybersecurity Maturity Model Certificate Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Our cybersecurity program is led by our CISO, a seasoned leader in the cybersecurity field with over 25 years of extensive experience across cybersecurity, IT, risk management, and regulatory compliance. Holding both a master's in computer engineering and business administration, our CISO is also a Certified Information Systems Security Professional ("CISSP"). Reporting directly to our CDTO, our CISO leads a dedicated team of information security and risk professionals. Together, they are entrusted with the crucial task of managing our information security and data protection operations.

companyName: RALPH LAUREN CORP

ticker: RL


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risk. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures.

companyName: Lovesac Co

ticker: LOVE


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of IT who reports to our Vice President of Finance, to manage the risk assessment and mitigation process.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: Our Chief Information Officer oversees our information security program. His teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. We devote significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage. Our information security program is integrated into our overall enterprise risk management program and shares common reporting channels and governance processes that apply to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our employees with network access participate periodically in required training, including phishing, spear phishing and other security and awareness training.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: In an effort to deter prevent and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: We have adopted, and periodically review and update, information security and privacy notices, policies and procedures. We maintain annual cybersecurity and data privacy training for all employees with access to our corporate systems. In addition, as part of our Payment Card Industry Data Security Standard compliance, we maintain annual role-based training on protecting payment card information for all relevant employees. We conduct proactive incident preparedness activities focused on cybersecurity risks and business continuity, such as annual table-top exercises with our senior management, as well as periodic phishing simulations to test our employees' responses to suspicious emails.

companyName: Under Armour, Inc.

ticker: UAA


text: As of the date hereof, the Company has not encountered cybersecurity incidents that the Company believes to have been material to the Company taken as a whole.

companyName: Triller Group Inc.

ticker: ILLR


text: The Board of Directors also receives periodic updates from management and the Audit Committee on cybersecurity risks. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Executive Officer. Management regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, vulnerability management, and on-going cybersecurity projects. While none of our directors has formal professional certifications in cybersecurity, several members of the Board have experience overseeing information technology and enterprise risk management in prior executive or board roles. The Board receives periodic updates on cybersecurity matters as part of its overall risk oversight responsibilities. Day-to-day responsibility for identifying and managing cybersecurity risks rests with our Director of IT Security & Future Solutions and his information security team. The team is responsible for monitoring our networks, systems, and data, implementing technical safeguards, conducting employee training, and coordinating incident response procedures.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team collaborates with our Head of Information Security to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Our Board dedicates time and attention to our cybersecurity and information technology risks. The Board executes its cybersecurity risk oversight function collectively and by delegating responsibility to our Audit Committee. Our CIO presents to the Board at least annually and to our Audit Committee at least quarterly, covering a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments, and management's ongoing efforts to prevent, detect, and address internal and external cybersecurity threats specific to our organization. These briefings also include periodic third-party cybersecurity program assessments, benchmarks, and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented and shared with our Audit Committee and the Board quarterly.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) our information security team works with management, including our Chief Technology Officer ("CTO"), to prioritize our risk management processes and mitigate cybersecurity threats that could more likely lead to a material impact to our business; (3) our senior management/committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the cybersecurity subcommittee of the audit committee of the board of directors, with the cybersecurity subcommittee reporting to the audit committee of the board of directors which evaluates and oversees our cybersecurity risk as part of our overall enterprise risk.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: Through ongoing communications with these teams, the Chief Technology Officer and the Cybersecurity Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the board of directors and the audit committee when appropriate.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Existing third-party relationships are monitored on a risk-by-risk basis via the Vulnerability Management Framework. Before entering into new third-party provider agreements, third-party providers and related services are subject to scrutinization and a review from the AVP of Cybersecurity's team.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH