text: Our cybersecurity policies, standards, processes and practices are also assessed by third party cybersecurity providers. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: VerifyMe, Inc.

ticker: VRME


text: Our risk management program includes focused efforts on identifying, assessing and managing cybersecurity risk, including the following: • A robust information security training program that requires all company employees with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with periodic testing to measure the efficacy of our training efforts. • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks. • Continuous and robust testing of our systems to assess our vulnerability to cyber risk, which includes targeted penetration testing, tabletop incident response exercises, periodic audits of our systems by outside industry experts and regular vulnerability scanning. • Engaging external cybersecurity experts in incident response development and management. • Business continuity plans and critical recovery backup systems.

companyName: BlueLinx Holdings Inc.

ticker: BXC

secItem: Item 1C


text: Securing the Company's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our various stakeholders. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational, financial and legal risks.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 and Center for Internet Security, Critical Security Controls (CIS Controls). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the National Institute of Standards and Technology Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: The Company's Chief Security Officer ("CSO") works collaboratively across the Company with other members of TTEC's leadership team to implement cybersecurity programs designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and respond to cybersecurity incidents.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: To date, the Corporation has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by the Corporation to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, the Corporation may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented the Corporation's cybersecurity controls and procedures are, and the Corporation may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: PENNS WOODS BANCORP INC


text: Our Audit Committee is responsible for the direct oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on at least a quarterly basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. Reports by management to the Audit Committee include existing and new cybersecurity risks, status updates regarding how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee's involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. As needed, this framework also includes consultations with our enterprise risk management committee, led by our Chief Compliance and Privacy Officer.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: Any third-party service provider or vendor utilized as part of the Company's cybersecurity framework is required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing sensitive customer data are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract executions, vendors undergo ongoing monitoring to ensure they continue to meet their security obligations.

companyName: FIRST BANCSHARES INC /MS/


text: On a periodic basis, the CISO provides reports and presentations to the board of directors, Audit Committee, and Rocket Senior Leadership, including the Rocket Risk Council. These CISO updates include recent industry developments, evolving standards, vulnerability assessments and technological trends. During 2024, the CISO updates included information regarding areas of increasing cybersecurity threats, the ongoing enhancements to our information security framework, deployment of security tools, processes to mitigate threats, and the results of a simulated cybersecurity incident tabletop exercise.

companyName: Rocket Companies, Inc.

ticker: RKT


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate such risks and potential material impacts. We implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. We prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as ransomware, theft of IP and interruption of services. The risk management and reduction measures we implement, depending on the computing environment or system, may include the following: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, disaster recovery/business continuity plans and clear desk policies; threat detection and incident response; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards and certifications; credit and background checks on our personnel and contractors; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; continuous monitoring for potential intrusions; vendor risk management program; employee security training; penetration testing; cyber insurance; and a dedicated cybersecurity staff and officer.

companyName: Cardlytics, Inc.

ticker: CDLX


text: As noted above, we have a designated Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. With over 25 years of experience in the field of information technology and cybersecurity, our Chief Information Officer brings a wealth of expertise to his role and maintains both Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA) certifications and additional personnel on our information security team have cybersecurity experience and certifications. Our Chief Information Officer's background includes extensive experience as an enterprise chief information officer and is well-recognized within our industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Officer reviews with senior management, at least quarterly, the status of our Information Security Program, identified threats to our data security, and cyber incidents relevant to our operations and reviews these matters with our Board and/or Audit Committee at least annually, or more frequently when appropriate. Further, at least quarterly, our senior leadership team, including our Chief Financial Officer, General Counsel, Chief Information Officer, Executive Vice President of Financial Services, and Global Risk Management, prepares a comprehensive summary of certain key risks facing the Company (the "Risk Report"). The Risk Report includes feedback from multiple constituencies within the Company, incorporating and evaluating heightened risk areas identified by senior management, functional area teams within the organization, and management at the regional and local dealership levels. In addition to various enterprise-wide risks identified throughout this management-led process, the Risk Report highlights cybersecurity risks, tasking the Chief Information Officer or his designees with the responsibility to monitor such risks and, as appropriate, implement risk mitigation strategies. The Risk Report also clarifies that both the Board and the Audit Committee retain oversight of such risks. The Risk Report is shared and discussed at least quarterly with the Audit Committee and periodically, with the full Board, with certain specified risks and mitigation efforts reported to the Board or designated standing committees on a more frequent basis, as appropriate.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Management Oversight Our Information Security Program is a comprehensive framework of policies, procedures, and guidelines designed to ensure the security, availability, and confidentiality of our systems.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large international companies. The CISO holds an undergraduate degree in business and a master's degree in business administration. The CISO also has attained the professional certification of Certified Information Systems Security Professional (CISSP). The CIO holds an undergraduate degree in business and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The Company's Chief Executive Officer and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Board is also made aware of material cybersecurity incidents which impacted the Fund.

companyName: Fidelity Private Credit Co LLC


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Operations—Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could each result in material harm to our business and reputation", "Risk Factors—Risks Related to Our Operations—Manufacturing, quality, or supply chain difficulties, disruptions, or shortages could lead to product supply problems", "Risk Factors—Risks Related to Our Operations—Reliance on third-party relationships and outsourcing arrangements could adversely affect our business", and "Risk Factors—Risks Related to Our Operations—Our use of artificial intelligence (AI) or other emerging technologies could adversely impact our business and financial results."

companyName: ELI LILLY & Co

ticker: LLY


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with our incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's management and its designees report to the board of directors for certain cybersecurity incidents.

companyName: Peraso Inc.

ticker: PRSO


text: CTO and the MSP engage in the periodic assessment and testing of CTO's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of CTO's cybersecurity measures and planning. The MSP regularly assesses CTO's cybersecurity measures, including information security maturity, and regularly reviews CTO's information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and CTO will adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: At least annually, the ISO reports to the Board of Directors the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed, as are management responses and any recommendations for program changes.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: The Company takes a risk-based, proactive approach to its management of cybersecurity threats inherent in our business. Our existing cybersecurity policy includes ongoing monitoring and detection programs, network security precautions, encryption of certain critical data, in depth security assessment of vendors and incident response guidelines. We continue to invest and improve in the protection of systems, sensitive data, technology, and processes using third-party and in-house tools and resources. We remain vigilant in staying ahead of new and emerging risks utilizing our in-house tools, and security teams review and make strategic investments in our systems to keep the Company, our guests and our team members' data secure. The Company's Vice President of Information Technology and Security is responsible for developing and implementing these controls and processes.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: For further information, please see our risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Board Oversight and Governance Our Board recognizes the important role of information security and mitigating cybersecurity and other data security threats. While the full Board has overall responsibility for risk oversight, it is supported in this function primarily by its committees. The Audit Committee is responsible for reviewing and discussing our policies with respect to risk assessment and risk management, including risks related to cybersecurity and other technology issues. The Board periodically evaluates our cybersecurity strategy to help ensure its effectiveness. Management provides periodic reports to the Audit Committee regarding cybersecurity and other information technology risks, as well as our plans to mitigate cybersecurity risks and to respond to any breaches, and to the Nominating and Corporate Governance Committee regarding governance matters related to cybersecurity and other information technology risks.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards to protect confidential client information in accordance with FDIC and FFEIC regulations. The program is tailored to align with the Company's risk profile, operational complexity, and strategic objectives.

companyName: First Financial Northwest, Inc.


text: At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial conditions. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For additional details, refer to Item 1A in Part I of this Amended 2024 Annual Report on Form 10-K/A.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and other relevant matters.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Our cybersecurity risk management program is considered by and integrated into our Company-wide Enterprise Risk Management program and shares common methodologies, reporting channels and governance processes that apply across the Enterprise Risk Management program to that of other enterprise level risks (such as product development, safety and surveillance, financial and intellectual property risks). Regular evaluations are conducted of the greatest risks to our business and their underlying risk drivers as well as the associated mitigation activities, maturity and controls. This program is overseen by our Executive Vice President and Chief Financial Officer and guided by the Enterprise Risk Council, a cross-functional group of the Company's business leaders representing key business functions that is co-chaired by our Chief Audit Executive. The results of the enterprise risk evaluations and the status and operation of the Enterprise Risk Management program are presented to our Board of Directors, which oversees the Company's enterprise-level risks.

companyName: AMGEN INC

ticker: AMGN


text: Role of the Board and Management in Cybersecurity Risk Oversight The Board's Risk Committee provides oversight of cybersecurity and privacy risks, including overseeing management's efforts to monitor and mitigate those risks and reviewing with management any significant privacy and cybersecurity incidents and the effectiveness of the Incident Management and Information Security Plan. The CIO and IT Management continuously address key management personnel on relevant cybersecurity issues, which can span a wide range of topics, including but not limited to recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, and the current threat environment.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, or CFO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Landos Biopharma, Inc.


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: To help mitigate this risk, Radian has designed and maintains an Information Security Program that is intended to protect our corporate data as well as data entrusted to us by our customers and partners. The Information Security Program is built on a risk-based approach that identifies and prioritizes cyber threats based on their potential impact on our strategy, operations, and assets. This program extends across all business lines and encompasses written policies on cybersecurity.

companyName: RADIAN GROUP INC

ticker: RDN


text: Our Security Operations Center team members have extensive experience in deploying and operating cybersecurity technologies which is enhanced on an ongoing basis through interactions with third party experts we employ to help protect the Company from cybersecurity threats. In addition, we maintain a global cross functional cyber crisis team which is responsible for evaluating cybersecurity threats and overseeing compliance with regulatory security requirements.

companyName: Amcor plc

ticker: AMCR


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • dedicated personnel principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the conduct of regular exercises and tests of our own systems to help discover potential vulnerabilities; • the use of external service providers, where appropriate, overseen by our IT team, to assist with assessing our systems, monitoring cybersecurity threats, including the proactive identification of vulnerabilities in our systems with threat intelligence, and our defenses against cyberattacks and providing timely cybersecurity threat alerts; • new-hire, annual and ad hoc cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan, or the Response Plan, that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process, overseen by our IT team, for key service providers, vendors and collaborators, including a due diligence process that involves the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.

companyName: Mersana Therapeutics, Inc.


text: a cybersecurity incident response charter and plan, and playbooks are maintained by the cybersecurity incident response team. The plan and playbooks are utilized during table-top exercises and trainings. Participants may include information technology, business, corporate function, and external resources depending on the table-top scenario; and third-party supplier security reviews are conducted based on risk. Reviews may include the assessment of security architecture, connections between our systems and the third party, data security controls, and user access controls.

companyName: TE Connectivity plc

ticker: TEL


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 36 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 27 years of information technology experience with a focus on information technology forensics.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Risk Assessment. The Company's internal cybersecurity team conducts regular assessments designed to identify vulnerabilities within the Company's systems and processes. These assessments are part of the Company's ongoing risk management strategy and inform strategic decisions regarding security investments and policy developments. The internal risk assessment process includes periodic reviews of the Company's charging infrastructure, software applications and operational procedures against best practices and address current and potential threats.

companyName: EVgo Inc.

ticker: EVGO


text: Although no cybersecurity incidents during the year ended December 31, 2023 had a material impact on our business strategy, results of operations or financial condition, the scope and impact of any future incident cannot be predicted. See Item 1A Risk Factors for more information about our information security and cybersecurity risks.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We require employees with access to information systems, including all corporate employees, to undertake data protection, cybersecurity, privacy and compliance programs at least annually. We maintain a team of dedicated security and compliance professionals who oversee cybersecurity risk management, mitigation, incident prevention, detection, and remediation, which is led by our Chief Information Security Officer ("CISO"). The team has deep cybersecurity experience with an average tenure of over 20 years with expertise in protecting critical assets for top firms in a myriad of different industries.

companyName: Digital Turbine, Inc.

ticker: APPS


text: Consistent with industry guidelines, such as the National Institute of Standards and Technology Cybersecurity framework, and regulatory requirements, guidelines and standards, b1BANK's information security and cybersecurity programs (collectively, "Program(s)") have been adapted to fulfill this obligation by establishing and employing administrative, technical and physical safeguards to maintain a secure and dependable infrastructure and environment. These Programs focus on identifying and addressing threats to the company and its customers and contribute corporate decision-making guidance for information security, cybersecurity and risk management objectives.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. This comprehensive approach to protecting the Registrants' assets, employees, and data - including customer information - utilizes a defense-in-depth approach, which enables the Registrants to continually evaluate enterprise-wide cyber and physical security risks. The Registrants' defense-in-depth methodology is based on leading cybersecurity frameworks, including: • U.S. Department of Energy's Cybersecurity Capability Maturity Model standard, • National Institute of Standards and Technology Cybersecurity Framework, and, particularly for the bulk electric system, • North American Electric Reliability Corporation's Critical Infrastructure Protection Standards.

companyName: OGE ENERGY CORP.

ticker: OGE


text: From time to time, we engage assessors, consultants, auditors, or other third-party service providers to enhance risk mitigation efforts. For instance, we periodically perform simulations and tabletop exercises for our technical teams and senior leaders to prepare for a possible cyber crisis and incorporate external resources and advisors as needed. We also engage third-party consultants and service providers to assist with penetration testing, security audits and vulnerability assessments in certain jurisdictions.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: The Audit Committee is primarily responsible for overseeing our enterprise risk management process on behalf of the Board of Directors, including cybersecurity risks. The CTO and CISO regularly provide reporting on cybersecurity matters to both senior management and the Audit Committee and at least annually to the Board of Directors. This reporting includes updates on our information security strategy, key cyber risks and threats, our progress towards protecting the Company from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our incident response plan.

companyName: CDW Corp

ticker: CDW


text: Board's Roles and Responsibilities The Audit Committee is responsible for overseeing and monitoring the Company's information security, technology, and cybersecurity program and other IT and data privacy risks, controls, strategies, and procedures. The Audit Committee is comprised of board members with expertise in the areas of risk management, finance and technology, enabling them to effectively oversee such cybersecurity and other IT and data privacy risks. The Audit Committee receives updates from management as needed or at least quarterly which cover the Company's current cybersecurity and other IT and data privacy risk assessments and key risk areas. The Audit Committee also reviews and discusses with management, at least quarterly, and as needed, any material or significant cyber incidents that have occurred or are reasonably likely to occur. In addition, the Audit Committee receives regular updates on cybersecurity trends and emerging threats from the Information Security Team led by the CISO.

companyName: ModivCare Inc

ticker: MODVQ


text: Our Risks from Cybersecurity Threats Our Cybersecurity Program is overseen by executives on our Executive Leadership Team and managed by our Cybersecurity Strategy Council, including our Senior Vice President, Chief Information Security Officer (CISO), who reports to our Executive Vice President, Chief Digital Officer (CDO). Our CISO is responsible for day-to-day risk management activities, including staying informed about and monitoring prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and the use of technological tools and software. Our CDO is responsible for our broader IT program, which includes PTC's ability to remediate and recover from a cybersecurity incident while reducing impacts to the business and operations. Our CDO and CISO regularly report directly to the Cybersecurity Committee of the Board of Directors on our Cybersecurity Program and efforts to prevent, detect, mitigate, and remediate issues. In addition, we have an escalation process in place to inform senior management and the Cybersecurity Committee and the Board of Directors of material issues.

companyName: PTC INC.

ticker: PTC


text: The Company has implemented a Cybersecurity Policy (the "Policy") that provides a framework for responding to cybersecurity incidents. The Policy includes requirements for incident disclosure and reporting, protocols for incident evaluation, including the use of third-party service providers and partners, and processes for notification and internal escalation of information to the Company's senior management, incident response team, and Board of Directors (the "Board") and appropriate Board committees. The Policy also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary but no less frequently than once a year, under the leadership of the Company's Chief Security Officer ("CSO").

companyName: AWARE INC /MA/

ticker: AWRE


text: Cybersecurity risk mitigation processes are integrated into the Company's Code of Conduct that all employees are required to review. Additionally, all employees with network access receive cybersecurity awareness training.

companyName: MGM Resorts International

ticker: MGM


text: We have implemented an IT vendor risk management policy that provides guidance in managing risks associated with IT vendors and business partners. We have also established a third-party risk management program and conduct pre-onboarding security assessments and annual re-assessments of our service providers to collect, track, and manage third-party security controls based upon the risk presented to the business. Any issues identified during assessment are tracked through to remediation.

companyName: FASTENAL CO

ticker: FAST


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

companyName: Lightstone Value Plus REIT II, Inc.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BC Partners Lending Corp


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. As part of our continued investment in developing our overall risk management process, going forward, our Global Director of IT will provide periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee will provide periodic reports to the board of directors on such matters.

companyName: Identiv, Inc.

ticker: INVE


text: We require our vendors to comply with our privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We implement enterprise-wide information security policies and security awareness training to promote compliance and enhance security awareness and vigilance among our workforce. This training is distributed to all employees and includes interactive training on the acceptable use of technology, secure software development practices and phishing simulations.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Our CISO served as the CISO for Hertz Global Holdings, Inc. (Hertz), and prior to joining Hertz, held progressively senior information security roles at Hitachi Vantara LLC, Hewlett-Packard Company, Symantec Corp. and Marketo, Inc.

companyName: UNISYS CORP

ticker: UIS


text: The Bank's Third-Party / Vendor Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.

companyName: BCB BANCORP INC

ticker: BCBP


text: Company's IT contractor is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying cybersecurity threats and incidents and managing the material risks associated with the cybersecurity threats. The Company's IT contractor engages third-party vendors and cybersecurity consortiums periodically for cybersecurity-related guidance and certifications.

companyName: Royale Energy, Inc.

ticker: ROYL


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Collective Audience, Inc.


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response plan and related policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Our team of cybersecurity professionals then collaborate with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies. As part of the above processes, we regularly engage external consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: uniQure N.V.

ticker: QURE


text: State regulators have increasingly enacted cybersecurity laws, including requirements for cybersecurity programs, data encryption, and breach notification. Many states have recently updated their data privacy regulations, and we expect this trend to continue. We actively monitor legislative and regulatory developments to ensure compliance.

companyName: BayCom Corp

ticker: BCML


text: CRC membership, which is subject to change from time to time, includes management leadership possessing a diverse range of education, experience and expertise, and is currently comprised of Company's CISO, chief accounting officer, head of internal audit, general counsel and chief compliance officer, head of litigation, head of human resources, head of IT operations and the manager of network security. The collective experience of this committee encompasses areas such as IT, network security, change and incident management, public company governance, accounting, financial controls, insurance, risk management, communications, human capital, and legal matters including securities, privacy and technology contracting.

companyName: REGENCY CENTERS LP


text: Cybersecurity risks are a growing threat to us and other businesses, including our ERP and other third-party providers, which are vulnerable to cyberattacks, malware, and other system failures that may result in unauthorized access, damage, and other harms to our business or reputation. Protecting the confidentiality, integrity, and availability of our business information, intellectual property, customer, patient and employee data, and technology systems is critical to our business and operations, ability to comply with regulatory requirements, and reputation.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: On an ongoing basis, we assess our people, processes, and technology, and when necessary, modify the overall program in order to meet the demands of the ever-changing cyber risk environment. As part of our regular training and readiness program, we conduct phishing and penetration testing campaigns in order to ensure that our employees are familiar with all types of phishing emails and similar threats.

companyName: Investview, Inc.

ticker: INVU


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the audit committee of our board of directors (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees our cybersecurity risk management program. The Audit Committee receives quarterly and, if necessary, ad-hoc reports from the Vice President of Operation & Information Technology and the Head of Information Technology on our cybersecurity and information technology risks, including data security incidents (material and those with lesser impact potential), annual risk assessments, risk identification and evaluation, and targeted remediation plans and related execution/delivery.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: ALLETE faces a number of cybersecurity risks in connection with its business. Although we believe such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See Item 1A. Risk Factors for additional information regarding our organization's cybersecurity risks, which should be read together with this Item 1C. Cybersecurity.

companyName: ALLETE INC

ticker: ALE


text: Risks from Cybersecurity Threats Although our computer systems and the computer systems of third parties on which we rely have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach. There are risks from cybersecurity threats that if they were to occur could materially affect the Company, including its business strategy, results of operations or financial condition, as discussed in "Item 1A. Risk Factors – Operational Matters – Our information systems or the information systems of third parties on which we rely may experience interruptions, breaches in security and/or a failure of disaster recovery systems that could result in a loss or disclosure of confidential information, damage to our reputation, impairment of our ability to conduct business effectively and increased expenses" and 'Item 1A. Risk Factors – Legislative, Regulatory and Tax – Compliance with existing and emerging privacy laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies, and any failure to protect the confidentiality of personal information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: We believe cybersecurity is critical to advancing our technological developments. As a manufacturing and technology company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: ZRCN Inc.

ticker: ZRCN


text: Crexendo has adopted System & Organizational Controls (SOC2) for the service organization responsible for Crexendo Hosted product and related corporate assets/entities. Implemented controls cover trust services criteria of security, availability, processing integrity, confidentiality, and privacy. Independent service auditors have been engaged to measure the efficacy of implemented controls.

companyName: Crexendo, Inc.

ticker: CXDO


text: Certain members of the Board of Directors have experience conducting oversight of cybersecurity risk management across different industries, including technology and finance. The Audit Committee is the primary committee responsible for overseeing the company's cybersecurity risks with the Board receiving updates on at least an annual basis.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Should we, or the third parties we do business with, fall victim to successful cyber-attacks or experience other cybersecurity incidents, the result could include negative consequences. Such consequences could include, but are not limited to: significant disruption of our operations and those with whom we do business, including losing access to important business systems; misappropriation of confidential information related to customers, counterparties, employees, or other parties; severe damage to our reputation; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated, or destroyed, or the inability to prevent systems from processing fraudulent transactions; violations of applicable privacy and other laws; financial loss to us or our customers, counterparties, or employees; exposure to the risk of litigation, regulation, and other liability, which may include fines or other penalties and increased cybersecurity or other insurance premiums. The extent of a particular cyber-attack and the steps we must take to investigate and respond to it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Material Impacts from Cybersecurity Threats and Incidents Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyber-attack will not occur. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: The Company recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats in order to safeguard our information systems and protect the confidentiality, integrity, and availability of our information systems and the information residing therein. We have implemented several cybersecurity processes to aid in our efforts to assess, identify, and manage such material risks.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which is overseen by an internal information technology specialist. Cybersecurity threats are identified and escalated to a member of Management pursuant to criteria set forth in these processes. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers, if any.

companyName: Sow Good Inc.

ticker: SOWG


text: Our cybersecurity risk management program not only fortifies our current defense but also serve as the building blocks for adopting an internationally recognized IT standards framework, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) or the International Organization for Standardization (ISO) 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.] Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: AIRGAIN INC

ticker: AIRG


text: Our cybersecurity risk management program, which is discussed above, is led by our CSO, who has 28 years of prior work experience in various roles involving managing information security of large-scale global security operations, including developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CSO maintains industry certifications, including an ISC2 Certified Information Systems Security Professional certification.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: We use a risk management framework based on applicable laws and regulations, and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. However, we may not be successful in fully addressing such areas for remediation or enhancement. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.

companyName: Meta Platforms, Inc.

ticker: META


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business could be negatively affected by security threats, including cybersecurity threats, and other disruptions".

companyName: TXO Partners, L.P.

ticker: TXO


text: Information technology systems, including our mobile or online platforms, mobile payment and ordering systems, loyalty programs and various other online processes and functions, are critical to our business and operations. The Company faces risks associated with cybersecurity, including operational interruptions, financial losses, personal information leakage and non-compliance risks. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors — The occurrence of security breaches and cyber-attacks could negatively impact our business." and "—Unauthorized access to, or improper use, disclosure, theft or destruction of, our customer or employee personal, financial or other data or our proprietary or confidential information that is stored in our information technology systems or by third parties on our behalf could result in substantial costs, expose us to litigation and damage our reputation."

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, and may experience, cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our service providers (including the transfer agent), and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: Arogo Capital Acquisition Corp.


text: We use third-party service providers to perform a variety of functions throughout our business, such as research collaborators, contract research organizations, contract manufacturers, suppliers, and distributors. Depending on the nature of the services provided, certain providers are subject to cybersecurity risk assessments at the time of onboarding and upon contract renewal. We also use various inputs to assess the risk of our third-party service providers, including information supplied by them. Depending on the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve various levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CFO, COO and Chief Executive Officer, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.

companyName: IN8BIO, INC.

ticker: INAB


text: Third-Party Risk Management Brighthouse Financial processes also address the cybersecurity risks associated with the use of third-party vendors, some of whom have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, the cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Members of our management team, most notably our Chief Financial Officer, who has responsibility for managing our Information Technology and Security functions, are responsible for leading our cybersecurity program. Our management team meets regularly with our information technology leadership personnel, including our Vice President, Head of Global Information Technology, who reports to our Chief Financial Officer, to receive updates and data on cybersecurity management activities, including assessments on emerging technologies and evaluations of recommended practices related to cybersecurity measures. Our Vice President, Head of Global Information Technology, who has decades of information technology leadership experience, and our Chief Financial Officer maintain their expertise through participating in events such as continuing education and training, and information-sharing collaborations. We also retain a third-party Information Security consulting firm to advise on and assess our cybersecurity processes on an ongoing basis.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: The Chief Information Office, which maintains our cybersecurity function, is led by our Chief Information Officer (CIO), who reports to our CEO. The Chief Information Security Officer (CISO) reports to the CIO and generally is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: For a description of our cybersecurity risks, refer to the risk factor in Item 1A. "Risk Factors," to this Annual Report on Form 10-K titled "If our information technology systems or data, or those of the third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan. We have devoted significant financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of the Company and its customers data and information management infrastructure. We have also implemented a review process to assess the security profile and data protection practices of third-party service providers that have exposure to our systems. We review and update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our internal audit department has a team responsible for IT and information security (including cybersecurity) audits. We also engage third-party cybersecurity consultants to conduct additional audits of our cybersecurity processes, provide assessments of our risk management programs and identify potential cybersecurity vulnerabilities. Our cybersecurity efforts also include mandatory training for all employees and contractors on OpenText's security and privacy policies as well as other ancillary trainings on topics such as phishing emails and other social engineering tactics.

companyName: OPEN TEXT CORP

ticker: OTEX


text: To identify and assess material risks from cybersecurity threats, we follow best practices in routine network and endpoint auditing, vulnerability assessments, penetration testing, and other forms of security auditing. We continuously monitor endpoint activity and network traffic for unusual or prohibited behavior to prevent, identify, and contain malicious actions.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 20 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities, our CIO, whose experience includes managing the technology professionals and processes at public commercial real estate advisors, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: The Audit Committee oversees our management of cybersecurity risks. Pursuant to the Audit Committee charter, the Audit Committee is responsible for discussing cybersecurity -related risks with management and the steps management has taken to monitor and control such risks, including our risk assessment and risk management policies. The CIO regularly reports to the Audit Committee on our cybersecurity risks, and the chair of the Audit Committee reports on these discussions with the full Board of Directors. In addition, the CIO provides periodic reports to our Board of Directors.

companyName: WisdomTree, Inc.

ticker: WT


text: Cybersecurity risks are monitored and evaluated by management through an internal compliance program with oversight by internal audit. We engage various third-party cybersecurity partners, such as auditors, assessors and consultants to perform penetration testing and audits on our cybersecurity profile. With the assistance of a third-party cybersecurity consultant, we also conducted three cyber breach simulation exercises in the last five quarters, focused on incident management and communication processes. These third-party partnerships enable us to leverage specialized knowledge and insights, and are meant to ensure our cybersecurity strategies and processes remain appropriately tailored to the company's risk profile. In order to promote a company-wide culture of cybersecurity risk management, management has also implemented programs to both test and train our employees on cybersecurity fundamentals, including both annual and ongoing information security awareness training.

companyName: Civeo Corp

ticker: CVEO


text: While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party vendors, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: GIFTIFY, INC.

ticker: GIFT


text: Air Group's management and Board consider cybersecurity to be a critical component of the Company's risk management plan. Our systems are subject to increasing and evolving cybersecurity risks. Unauthorized parties have attempted and continue to attempt to gain access to our systems and information, including through fraudulent misrepresentation and other means of deception. The systems of our suppliers, vendors, and other business partners are also at risk. The threat of cybersecurity incidents is included within our company's annual enterprise risk management (ERM) program that assesses the most significant risks to the enterprise.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Our Vice President of Information Technology's experience includes various roles in information technology and information security for over 15 years. Members of the Cybersecurity Team each hold undergraduate and, in some cases, graduate degrees in their respective fields, and each have experience managing risk at the Company or at similar companies, and assessing cybersecurity threats.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Our board of directors has approved a committee comprised of directors and management called the Information Technology Committee. This committee provides oversight and governance of the technology program and the information security program. This committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur from time to time in accordance with the Business Continuity Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents.

companyName: Southern States Bancshares, Inc.


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Hempacco Co., Inc.

ticker: HPCO


text: Regular assessments and reviews, both internal and independent, are conducted on Palantir information assets and networks, including systems, devices, applications, and related computing resources, to evaluate potential risks and vulnerabilities, identify actions to be taken, and evaluate the effectiveness of our cybersecurity program and controls. Risk management exercises occur regularly, and in response to changes in Company operations, risk landscape, and threat actor activities using threat modeling, risk forecasting, and other techniques to identify where investments in security should be made. Internal assessments occur based on results from risk management exercises, changes in infrastructure, cybersecurity risks, threat actor activity, and in response to other internal or external events. External assessments are conducted by independent assessors, consultants, or auditors, as relevant, and occur regularly in order to maintain our certifications and accreditations with certain compliance regimes (for example, FedRAMP).

companyName: Palantir Technologies Inc.

ticker: PLTR


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored and escalated appropriately, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"), who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Management, the CISO and our cybersecurity team, periodically update the Risk Committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.

companyName: Payoneer Global Inc.

ticker: PAYO


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CISO/CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including monitoring systems and employee engagement.

companyName: AmeriCann, Inc.


text: Our cybersecurity risk management program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews the Company's cybersecurity risk management approach and interacts with various members of management. • Collaborative Approach. We use a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and have implemented procedures designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including next-generation firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to support this, we highlight best practices with a dedicated Cybersecurity month. We communicate the evolving information security policies, standards, processes and practices with personnel throughout the year.

companyName: Enova International, Inc.

ticker: ENVA


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for each vendor, security questionnaires, audits, and review of security reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Confluent, Inc.

ticker: CFLT


text: Our Chief Administrative Officer leads our information security organization (overseeing work done by a third party IT services company) and reports to the Chief Executive Officer and Board of Directors of any material information regarding such cybersecurity matters.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: At the management level, our CIO, certain directors on our information technology team, and our director of risk management, in consultation with our senior management team, have broad oversight of our cyber risk management processes. Our information technology team regularly discusses the risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. Our CIO joined the Company in 2024 and has extensive cybersecurity knowledge and skills gained from over three decades of experience in technology management, product management, strategic planning, and team leadership. She leads the team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business and reports directly to our Executive Vice President and Chief Marketing Officer. Our CIO and her team continue to implement, monitor, and maintain our cybersecurity program and provides reports on cybersecurity threats to management on an ongoing basis. In conjunction with management, this team regularly reviews our risk management measures to identify and mitigate data protection and cybersecurity risks and also works closely with our legal team to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: We maintain programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyber-attacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cyber-security and leveraging emerging technologies.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: While extensive cybersecurity controls and procedures are in place, the risk of experiencing an incident can never be eliminated completely. We maintain and regularly review and update an Incident Response Plan designed to address adverse events that could impact the security of information, that affect our ability to conduct secure financial transactions, or that present reputational risk.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments and policies with respect to the Company's IT systems, privacy, information governance and cybersecurity management. The Audit Committee meets with management at least annually, and as necessary, to review the Company's IT security program, compliance and controls with the CFO and/or CISO, including the potential impact of data privacy risk exposures on the Company's business, financial results, operations and reputation, the steps management has taken to monitor and mitigate such exposures, and major legislative and regulatory developments that could materially impact the Company's data privacy risk exposure.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Monitoring Cybersecurity Incidents The IT Manager is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to our executive management team, the Audit Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, supply chain resources (including warehousing and cold storage) and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes, for example, internal reviews of vendor security programs and assessments, security assessment calls with vendor personnel and imposition of information security obligations in our vendor contracts. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Vital Farms, Inc.

ticker: VITL


text: In 2023 and 2024, cybersecurity incidents occurred involving our vendors and other contractual counterparties that did not materially and adversely impact our operations. However, we cannot assure that future third party incidents will not materially and adversely impact us. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this annual report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in a material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our ability to provide services to our customers, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits and otherwise adversely affect our operations."

companyName: ONITY GROUP INC.

ticker: ONIT


text: We recognize that cybersecurity incidents are often a result of employees' actions, including responding to phishing emails, opening malicious attachments, or visiting compromised websites. Therefore, another aspect of our cybersecurity program focuses on preventing such incidents by way of strong email security, web browsing protection systems, and by providing regular education and communication to our employees to increase their cybersecurity awareness of how to detect and respond to cyber threats. We periodically assess our employees' awareness level of these risks by conducting periodic phishing tests.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: The Board of Directors (the "Board") oversees NACCO's risk management. The full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of the Company's cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2023, the Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and distributors. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a review of certain vendor's written security program, a risk assessment for certain vendors, and imposition of information security contractual obligations on such vendors.

companyName: GENELUX Corp

ticker: GNLX


text: The Head of Information Technology, in coordination with the Data Privacy and Security Committee, which includes our Chief Executive Officer, or CEO, Chief Operating and Financial Officer, or COO and CFO, and General Counsel, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of Information Technology and the Data Privacy and Security Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Our cybersecurity risk management program is integrated into our operations and is widely communicated to employees through periodic (not less than annual) employee and contractor cybersecurity awareness training, which includes information about how to identify and report cybersecurity concerns and incidents. Our information technology organization also conducts phishing simulations and testing scenarios to help ensure compliance with our cybersecurity policies and procedures. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on a continuous basis through automated tools and 24x7 managed services that detect threats and trigger alerts for assessment, investigation, and remediation by our information technology organization.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: Our CIO, FVPIS, and SVPITSS collectively have over eight decades of IT and cybersecurity experience, including five decades in senior-level leadership roles. Our FVPIS spent over three decades in federal law enforcement working in cyber related roles.

companyName: PRICESMART INC

ticker: PSMT


text: While we have prevented cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows.

companyName: Nakamoto Inc.

ticker: NAKA


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program.

companyName: CHARLES & COLVARD LTD


text: We regularly discuss our internal controls over financial reporting with our independent registered public accounting firm and other service providers assist us in evaluating the design and implementation of our cybersecurity controls and procedures, as well as to monitor and test our safeguards.

companyName: Lyft, Inc.

ticker: LYFT


text: To date, no risks from cybersecurity threats from Longbridge have materially affected or are reasonably likely to materially affect our Company. Cyber criminals do, however, target us and Longbridge's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Longbridge's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's and Longbridge's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our stockholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows."

companyName: Ellington Financial Inc.

ticker: EFC


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our incident response team, which includes, but is not limited to, our Vice President, Technology & Information Security, General Counsel and Chief Financial Officer. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer, or CTO, to develop and advance the firm's cybersecurity strategy, which applies to us.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to proactively address cybersecurity threats and prevent incursions and to communicate the Company's evolving information security policies, standards, processes and practices. Our awareness program includes assessment of our personnel's preparedness through regular phishing e-mail alerts, highlighted banners that warn about external senders, and tests administered to help the Company's personnel interrogate, navigate around, and avoid clicking suspicious and unfamiliar links from unknown senders.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: The ISD, under the direction of the TISD, is responsible for overseeing the organization's cybersecurity and promoting a security-centric culture throughout our operations. The ISD is at the forefront of enhancing our cybersecurity framework and strengthening the overall cybersecurity program. Additionally, the ISD oversees the cyber risk management function, which identifies cybersecurity threats and assesses cybersecurity risks. Our ISD has more than 12 years of experience in the cybersecurity field and holds a Computer Engineering degree.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: To date, there has not been any previous cybersecurity incident that has materially affected the Company's business strategy, results of operations or financial condition.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Our assessment and management of risks from cybersecurity threats are part of the Company's overall risk management processes. Our Director of Information Technology works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity Governance One of

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: As disclosed in our Form 8-K filed on July 14, 2023, on or about May 31, 2023, we were informed by a third-party vendor of a zero-day vulnerability in the vendor's managed file transfer software MOVEit (the "Vendor Incident"). The Bank utilizes MOVEit for securely transferring sensitive and confidential information and other data, including for its First National 1870 and Guardian Mortgage divisions.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: The Company maintains a decentralized information technology infrastructure, where each of our business units utilizes a separate and distinct information technology system. This means that if any business unit's systems are compromised, there is less risk that another business unit will be impacted by that event. This decentralized structure also allows our information security professionals embedded within an individual business unit to make quick, efficient decisions when changes or actions are needed and provides an additional safeguard for our data and systems.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess, identify, and manage material risks from cybersecurity threats and incidents, as described above under "Cybersecurity Risk Management and Strategy." The CISO has served in this role since 2022, and has over 20 years of professional experience in identifying, evaluating, and responding to cybersecurity threats and incidents. The CISO holds a bachelor's degree in electrical engineering from Arizona State University and is a Certified CISO under the Carnegie Mellon University CISO Certification Program, a Certified Information Systems Auditor (CISA), and a Certified Information Systems Security Professional (CISSP). Members of the Crisis Response Team have extensive work experience in systems and programming, auditing, compliance and privacy laws, financial controls and procedures, and operations management. With the assistance of the CISO, along with our internal cybersecurity and information technology professionals and our third-party cybersecurity consultants and advisors, the Crisis Response Team is charged with the responsibility of preventing, detecting, mitigating, and remediating cybersecurity threats and incidents.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" and "We use AI in our business, and its use could result in reputational harm, competitive harm, cybersecurity risks and legal liability, which could have a material adverse effect on our results of operations" in Item 1A. Risk Factors.

companyName: SAIA INC

ticker: SAIA


text: Our Chief Executive Officer previously served as Chief Technology Officer at three other large media and telecommunications companies prior to becoming our Chief Executive Officer, which gave him significant security technology and operational responsibility over large networks. Our Chief Executive Officer had also led the venture arm at another leading telecommunications company which had invested in a number of IT security technology companies. The other members of our senior leadership team hold undergraduate and graduate degrees in their respective fields and have experience managing risks.

companyName: Liberty Latin America Ltd.

ticker: LILA