text: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices Detect anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program Respond to incidents regardless of source or causality Recover through planning, improvements and communications (external and internal)

companyName: VanEck Bitcoin ETF

ticker: HODL


text: Our Chief Financial Officer is responsible for assessing and managing our cyber risk management program and informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Audit Committee of the Board of Directors is responsible for overseeing risks related to cybersecurity.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC

secItem: Item 1C


text: As part of our cybersecurity risk management strategy, each cyber threat is evaluated for materiality and escalated based upon evaluation of the potential severity and risk impact on our operations. We have not experienced a material cybersecurity breach in the past three years. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from penalties or settlements related to a cybersecurity breach during that time. For more information regarding cybersecurity-related risks that could materially affect our business strategies, results of operations, or financial condition, please see Item 1A in this Form 10-K under the headings "Information technology disruptions, including as a result of cybersecurity breaches, could compromise our information, which would cause our business and reputation to suffer."

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Cerevel Therapeutics Holdings, Inc.


text: The Chief Financial Officer will oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. The Audit committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Our Chief Security Officer and our Chief Information Officer report to our Security Committee, which oversees monitoring and incident response, risk mitigation, supply chain security, physical security, product security, insider trust, and other security related items and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Security Officer and Chief Information Officer have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Security Officer monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our security team, and through the use of technological tools and software and results from third party assessments.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Policies and Standards We have a comprehensive collection of documented policies and standards that are leveraged to establish and affirm expectations for security controls, mitigate known cybersecurity risks and provide consistent levels of protection across the Company. Our policies and standards are effective in meeting numerous compliance requirements while simultaneously reducing duplication of controls.

companyName: Loar Holdings Inc.

ticker: LOAR


text: Unsecured Human Machine Interfaces: Without proper security measures, human machine interfaces can be accessed by unauthorized users, allowing them to view and adjust real-time system settings.

companyName: YORK WATER CO

ticker: YORW


text: The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. Risk-based analysis and judgment, along with a recognized security framework, are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: We recognize the critical importance of maintaining the safety and security of our systems and data, and have a holistic approach for overseeing and managing cybersecurity and related risks. Our Board of Directors (the "Board"), the Audit Committee of the Board (the "Audit Committee"), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. A key component of this is our standing Security Steering Group ("SSG") whose members include, among others, our Chief Information Security Officer ("CISO"), Chief Product Officer, and Chief Technical Systems Officer. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and practices will be properly followed in every instance or that they will be effective.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: We have adopted a comprehensive cybersecurity assessment framework, which is integrated into our security team's processes to ensure cybersecurity incidents are assessed and escalated in a timely manner, so that certain leaders within our organization further investigate, respond to, and remediate, the incident. Certain members of the Company's executive leadership team will also consider potentially applicable legal and regulatory obligations and take action to mitigate brand and reputational damage. In fiscal 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. If a cybersecurity incident is determined to be material, in accordance with reporting requirements applicable to us, our comprehensive cybersecurity assessment framework outlines our controls and the procedures adopted to ensure timely compliance with our reporting obligations.

companyName: SecureWorks Corp


text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"), which includes processes for assessing, identifying and managing material risks from cybersecurity threats. The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day-to-day basis by Main Street's General Counsel and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Operating Officer and Main Street's General Counsel. Main Street's General Counsel also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan, with Main Street's Chief Operating Officer and Main Street's IT Manager also included on the crisis response team. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of Main Street's IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. Main Street's IT Manager has over 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity systems, policies and procedures. Main Street's General Counsel has served in his oversight function as General Counsel for over 16 years and previously as Main Street's Chief Compliance Officer for over 12 years, during which time he has gained expertise in assessing and managing risk applicable to the Company. Similarly, each of Main Street's Chief Executive Officer and our Main Street's Chief Operating Officer have served in various executive management roles at the Company and, in the case of our Main Street's Chief Operating Officer, other publicly traded organizations, involving extensive oversight and management of risks, including cybersecurity related risks, for over 20 years.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: the Company has not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company's business, results of operations, or financial condition.

companyName: REST EZ Inc.

ticker: RTEZ


text: Remote Access Policy (the "RAP"). The RAP defines the Company's standards for accessing IT resources from outside the Company's network, such as when an employee is working remotely. Pursuant to the RAP, remote access is only permitted if accomplished through secure, Company-provided means. The Company's uses remote-access software designed to guard against unauthorized access using traffic encryption during transmission and firewall protections.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Our CEO, CFO, and VPIT play a pivotal role in informing the Board regarding cybersecurity risks. They provide an annual comprehensive briefing to the Board, as well as interim updates throughout the year, as needed. The VPIT holds a Certified Information Systems Security Professional certification and an Engineering degree from Queen's University in Canada, and he has over twenty years of experience in cybersecurity. Our executive leadership team (composed of our CEO, CFO, and other senior officers representing functional and business areas) has ultimate management responsibility for our cybersecurity program. The executive leadership team meets regularly to discuss our strategy, opportunities and risks, including our risk management measures used to identify and mitigate cybersecurity threats.

companyName: Orion Group Holdings Inc

ticker: ORN


text: We have an IRP to prepare for and respond to cybersecurity incidents. Our IRP processes are tested in annual tabletop exercises to help identify strengths and areas for improvement. Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management team. Our Audit Committee is responsible for the Board-level oversight of risks from cybersecurity threats. Members of our Audit Committee receive updates from our management team regarding Company practices, programs, and other developments related to cybersecurity throughout the year, including quarterly updates from our Chief Legal Officer on cyber threats and our cybersecurity risk management and strategy program. Our Audit Committee is comprised of Board members with diverse expertise, including risk management and strategy, equipping each member to oversee cybersecurity risks effectively.

companyName: Piedmont Lithium Inc.


text: The Audit Committee of the Board of Directors, as overseen by the full Board of Directors, is responsible for oversight of cybersecurity risk. Our IT executives report on our cybersecurity practices and risks at each meeting of the Audit Committee of our Board of Directors. In addition, our IT executives provide periodic updates on cybersecurity risks to our management at regularly held executive committee meetings. Should any cybersecurity threat or incident be detected, our IT executives would timely report such threat or incident to the management executive committee and provide regular communications and updates to the executive committee throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. Any incident identified by the management executive committee as having a material impact would be promptly escalated to all members of the Board of Directors. Should there be an incident which does not rise to the level of being material, such incident would, at minimum, be included in the subsequent IT reports to both the management executive committee and the Board of Directors.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: The Technology, Environmental, Safety and Security Committee of our Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: During the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see Item 1A "Risk Factors" in this Annual Report on Form 10-K.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: HEI's cybersecurity governance is primarily integrated within Hawaiian Electric's cybersecurity governance plan and processes. HEI's board of directors and CWG are tasked with overseeing risks from cybersecurity threats through routine quarterly, or as needed, updates and periodic deep-dive sessions. These updates provide updates on cybersecurity incidents, as well as overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Notwithstanding any of these measures, our systems and networks remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "If our security measures are compromised, or our information technology systems or those of our vendors, and other relevant third parties fail or suffer security breaches, loss or leakage of data, and other disruptions, this could result in a material disruption of our services, compromise sensitive information related to our business, harm our reputation, trigger our breach notification obligations, prevent us from accessing critical information, and expose us to liability or other adverse effects to our business." in Item 1A. "Risk Factors."

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: 3. Vendor Risk Management: PyraMax Bank evaluates and manages the cybersecurity risks associated with third-party vendors. Vendor contracts include provisions for security requirements, regular assessments, and compliance with industry standards.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The cybersecurity function within Yubo Beijing helps identify, assess and manage its cybersecurity threats and risks. The cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to management. Yubo Beijing implements and maintains various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to the Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and has primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Chief Financial Officer ("CFO")

companyName: LogicMark, Inc.

ticker: LGMK


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: We conduct regular risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Our business operations rely on the secure processing, storage, integrity, and transmission of business-critical information, including transaction information as well as personal and other sensitive data, through digital and interconnected systems, including those of our service providers and other third parties. In order to identify, prevent, respond to, and mitigate cybersecurity risks, we maintain a formal data protection program with physical, technical, and administrative safeguards (the "Program"), which is integrated into our overall risk management processes. As part of the Program: • We have implemented and maintain documented policies and comprehensive technical controls (including multifactor authentication and end-to-end encryption) designed using the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and mapped to the specifications of International Organization for Standardization ("ISO") 27001. The Program is regularly reviewed and updated on an annual basis, with a comprehensive annual review cycle. • We maintain a dedicated cybersecurity team under the joint direction of our Executive Vice President and President – Global Platforms Group, and our Chief Information Security Officer ("CISO"). Our cybersecurity team operates a 24/7 Security Operations Center that employs threat detection and response technologies, including AI and ML capabilities. In addition, we maintain the Ingram Micro Trust Center, a centralized hub for stakeholders and the public to access key information about our cybersecurity and privacy programs. • We regularly test our internal IT controls through a combination of automated and manual testing procedures, including continuous automated vulnerability scanning and periodic penetration tests, and we regularly test our disaster recovery and other back-up plans. Our Program also undergoes annual external audits by independent auditors as part of our ISO 27001 certification process. Critical vulnerabilities identified through these processes are remediated according to defined timelines based on severity and other relevant factors. • We maintain, and we require our third-party service providers to maintain reasonable security controls designed to protect the confidentiality, integrity, and availability of our information systems and the sensitive data we process or that is processed on our behalf. We address potential risks posed by the use of such third-party service providers via established vendor risk assessments, due diligence, and contract review by our cybersecurity team. • We require our employees to complete security awareness training upon hiring and on a regular basis, with modules covering applicable Company policies and emerging threats. Our training program includes practical exercises such as simulated phishing campaigns.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company- wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our Risk Management Team (see " Management's Role Managing Risk " below for details regarding the team members and scope) works closely with our Information Technology (" IT ") team (our " IT team ") to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The Audit Committee is responsible for evaluating Celestica's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee's Mandate also requires it to discuss guidelines, policies and steps to govern the process by which risk assessment and management is undertaken (including risks related to information security, cybersecurity and data protection) and the establishment and management of appropriate systems to manage such risks. The Audit Committee reviews cybersecurity risks through quarterly reports from management, and monitors the status of existing information security controls and practices to mitigate the potential risk from evolving cybersecurity threats.

companyName: CELESTICA INC

ticker: CLS


text: Identified cybersecurity risks, including third-party risks and internal risks, are documented and managed in a risk register, which is reviewed monthly with leaders of our internal audit, compliance, and IT departments to ensure visibility and consensus in a separation-of-duties structure. Risks are stratified according to a standard calculus of probability, severity and materiality.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our Board maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.

companyName: MAYS J W INC

ticker: MAYS


text: The Committee is responsible for the oversight of the Company's policies and procedures intended to provide security, confidentiality, availability, and integrity of the Company's information, including with respect to data privacy and the Company's compliance with applicable data privacy and cybersecurity laws and regulations. The Committee also oversees the quality and effectiveness of the Company's policies and procedures with respect to its information technology systems and provides oversight on the Company's policies and procedures in maintaining preparedness for responding to any material incidents. The Committee also periodically coordinates with the Company's Audit Committee, which reviews risks related to the Company's information technology systems, including privacy, network security and data security.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Cybersecurity threats represent a paramount concern for the Company. Our information systems department collaborates closely with senior management to implement a comprehensive program aimed at safeguarding our information systems and promptly responding to cybersecurity incidents, adhering to established incident response and recovery protocols. Cross-functional teams are deployed across the organization to address and mitigate cybersecurity threats, with senior management overseeing prevention, detection, and remediation efforts in real-time, reporting significant developments to the Board and Audit Committee as necessary.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: Although our information security program is designed to attempt to prevent, detect and respond to a cybersecurity incident, there can be no assurance that such an incident will not occur. A cybersecurity incident could cause the failure of our information security systems or those of our third-party service providers, which could materially impact our ability to perform certain critical functions, affect the confidentiality, availability or integrity of our proprietary information and expose us to litigation and increase our administrative expenses.

companyName: Enstar Group LTD


text: A formal process exists through our enterprise risk management matrix developed by the management team of the Company that tracks the Company's material risks, associated mitigation and remediation strategies and direct accountability which is submitted quarterly to the Audit Committee for review and oversight.

companyName: CSP INC /MA/

ticker: CSPI


text: Westwood has an established vendor management policy, which considers risks related to new or existing vendors, defines new vendor selection, vendor renewal, vendor monitoring and vendor risk assessment. The review of vendors is led by our Chief Compliance Officer and each vendor relationship owner, and involves reviewing System and Organization Controls reports, Statement on Standards for Attestation Engagements number 18 reports, and other reviews of internal controls.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Enterprise Security, Compliance and Data Protection team consists of subject matter experts in the field on Information Security, Risk Management Compliance and Data Protection. Our Security, Compliance and Data Protection teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO is part of the senior management team and regularly updates the Audit Committee on the company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: We employ governance, risk, and compliance (GRC) information technology tools to manage cybersecurity risks and maintain business continuity and disaster recovery plans to prepare for potential disruptions. Our employees receive cybersecurity awareness training upon hiring, with additional training provided on a regular basis.

companyName: STAR GROUP, L.P.

ticker: SGU


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: As part of our risk management processes, we have an enterprise-wide cybersecurity program aligned to the NIST Cybersecurity Framework (CSF). Our program is a risk-based program designed to protect our information systems through multiple defenses and layers of security, commonly referred to as a "Defense in Depth" approach. Key elements of our program include:

companyName: Zoetis Inc.

ticker: ZTS


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: Getty Images has a global Information Security Incident Response Plan (the "Plan") for identifying and managing cyber and data security threats. The Plan defines the roles and responsibilities of Company stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. A cross-functional working group of security, privacy, and legal personnel review significant incidents to determine if further escalation is appropriate. If an incident could be deemed material, it is escalated to the CTO and other members of the executive team, and we consult with outside counsel during this assessment as appropriate. • Technical Safeguards: Getty Images seeks to continuously improve technical safeguards that are designed to protect its information systems. Standards include controls for identity and access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While Getty Images seeks to maintain adequate cybersecurity controls, it may not always be effective. See "Item 1A. Risk Factors—Our failure to protect the proprietary information of our customers and our networks against cyberattacks, security breaches or unauthorized access could adversely affect our business and results of operations, damage our reputation and expose us to liability" and "We collect, store, process, transmit and use personal information, which subjects us to governmental regulation and other legal obligations in many jurisdictions related to privacy, information security and data protection" for more information as well as related risks. • Education and Awareness: We require annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. • Third-Party Risk Management: We rely on certain third-party computer systems and third-party service providers in connection with providing some of our services. We also depend upon various third parties to process payments for our transactions around the world. These third-party business partners, service providers, and consultants need to access our customer and other data and in some cases connect to our computer networks. We define expected security and privacy requirements through our contracting processes with third parties and we perform third-party cyber risk assessments to monitor the cyber risk management efforts of third parties as needed. • Threat Intelligence: Our security teams engage in threat intelligence, predictive modeling, and penetration testing to understand the Company's threat landscape and reduce the risk and impact of cybersecurity incidents.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: The CISO will identify processes or controls to mitigate identified risks to the security or integrity of each Information System. The computer system security requirements set forth below in this policy may adequately mitigate certain identified risks. Other processes or controls may be required to adequately mitigate other risks.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Our cybersecurity program and function is overseen by the Director of Information Technology ("Director of IT"), who has over 15 years of experience leading information technology divisions in various industries. The Director of IT collaborates with all business units to identify and assess cybersecurity risks and compliance with company policy. The Director of IT stays aware of emerging threats and trends in cybersecurity through attendance at cyber security conferences, subscription to the CISA.gov mailing list, various tech focused news outlets, and other sources.

companyName: Biofrontera Inc.

ticker: BFRI


text: Our cybersecurity program is integrated into our overall risk management framework and is aligned with industry standards and best practices. It includes regular risk assessments, vulnerability scans, penetration testing, and employee training programs. We use a layered approach to cybersecurity, leveraging firewalls, encryption, multi-factor authentication, and endpoint protection technologies to safeguard our systems and data.

companyName: Frequency Holdings, Inc

ticker: FRQN


text: Our overall cybersecurity program includes, amongst other things: • security tools, technologies and processes, control reviews, policy reviews, penetration tests, and investments in our security infrastructure; • cybersecurity awareness training exercises for our employees, including phishing simulations to raise awareness of spoofed or manipulated electronic communications, and other critical security threats; • annual review of System and Organization ("SOC") reports for our core third-party providers based on our assessment of their respective criticality and risk profile; and • a Cybersecurity Incident Response Plan that provides a framework and guidelines for responding to cybersecurity incidents that may compromise the confidentiality, integrity, and availability of our critical systems and information.

companyName: KILROY REALTY CORP

ticker: KRC


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements. Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.

companyName: IGC Pharma, Inc.

ticker: IGC


text: The Cybersecurity Incident Response Plan was developed to respond to cybersecurity incidents. A cybersecurity incident can include, but is not limited to, disruptions of service, denials-of-service, compromises of information systems, data exfiltration or data corruption. The plan provides a streamlined approach that can be invoked rapidly to address matters that raise enterprise concern and to communicate impact, actions, and status to senior management, including the CISO, CIRO, and appropriate stakeholders. The plan design includes enterprise-level response plans, including escalation to appropriate Board-level governance committees, and is reviewed, tested, and updated regularly.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: We engage third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology, our management and the Interim Chief Technology Officer of the Manager that implement and oversee our cybersecurity program.

companyName: VINEBROOK HOMES TRUST, INC.


text: Our management team, including the Vice President of IT and the Senior Vice President of Finance, General & Administrative, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of experience leading technology management functions within biotech companies as well as interacting with the Board.

companyName: CARGO Therapeutics, Inc.


text: The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as, payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).

companyName: VIASAT INC

ticker: VSAT


text: The Board of Directors considers cybersecurity risk as critical and delegates cybersecurity risk oversight to the Audit Committee. The Audit Committee thoroughly evaluates our cybersecurity program, risks and corresponding mitigations.

companyName: GRAPHJET TECHNOLOGY

ticker: GTIJF


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership manages our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.

companyName: TUCOWS INC /PA/

ticker: TCX


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company's IT function focuses on current and emerging cybersecurity matters. The Company's IT department is led by the Director of IT, who reports to the Company's Executive Vice President, Operations, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, the Director of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. The Director of IT has served at Sitio since 2022 and has over 19 years of experience in managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs at Sitio and similar companies.

companyName: Sitio Royalties Corp.


text: Our Board of Directors holds oversight responsibility over SOPA's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee oversees the management of SOPA's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: SOCIETY PASS INCORPORATED.

ticker: SOPA


text: Primary responsibility for assessing, identifying, and managing our cybersecurity risks rests with our management. To assist our management with such responsibility, we engage and consult with an external third party information technology consultant who reports to our Chief Accounting Officer. We also perform an annual cybersecurity assessment designed to help improve the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Network and information systems and other technologies, including those related to our network management, are important to our business activities. As a result, we have multiple layers of security designed to detect and deter cybersecurity incidents. As part of our overall ERM program, we monitor and test our safeguards and train our employees on these safeguards, in certain instances with the assistance of our external third party information technology consultant. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings. We also maintain an incident response plan designed to respond to, mitigate and remediate cybersecurity incidents according to a defined set of severity ratings based on the potential impact to our business, information technology systems, network or data, including data held or information technology services provided by third-party vendors or other service providers.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: Cybersecurity Program Governance Our cybersecurity program is led by our Vice President of Information Security, North America, who reports directly to our CFO and oversees the dedicated team responsible for executing our cybersecurity strategy, including the primary assessment and management of cybersecurity risks. Our cybersecurity leadership team also includes our Senior Director, Technology, Infrastructure & Cyber Defense and our Senior Director, Security & Strategy. The Board receives quarterly updates on material security incidents, detection, monitoring, security culture scores, and other key initiatives and notable events from our cybersecurity leadership team.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: The principal role of our board of directors and the Safety Committee is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter. The board of directors and the Safety Committee also receive updates, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for Ecovyst's management and Board of Directors. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain.

companyName: Ecovyst Inc.

ticker: ECVT


text: Our Chief Legal Officer and representatives from our security governance steering committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Legal Officer and representatives from our security governance steering committee provide annual briefings to the board of directors on cybersecurity risks and activities.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Management is responsible for the day-to-day administration of our risk management strategy and our cybersecurity policies, processes, and practices. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity risks and potential related impacts on our Company.

companyName: Guardion Health Sciences, Inc.


text: In the event of a cybersecurity incident, our incident response process is designed to detect, respond to, and mitigate the impact. Significant incidents are escalated to a team of business leaders, including our Chief Executive Officer, and Chief Financial Officer, who work with our incident response team to assess and address the situation. The Audit Committee oversees management's response to significant incidents and ensures compliance with disclosure requirements.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: Our CISO and Chief Risk Officer report to our Chief Operating Officer. These officers, along with our Chief Product and Technology Officer and our Chief Information Officer, drive our cybersecurity priorities at the executive level.

companyName: Dayforce, Inc.

ticker: DAY


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to our legal, compliance, strategic, operational, and financial risk areas.

companyName: LANDS' END, INC.

ticker: LE


text: Systems and Processes To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company's legal and internal audit functions, and facilitates the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our risk mitigation efforts. During the year, our senior management periodically identifies the cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to the risk level or the Company's mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may consult with outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans. The Audit Committee of the Board regularly receives reports from such outside experts in response to emerging or higher risk areas.

companyName: GLAUKOS Corp

ticker: GKOS


text: Training and Education Our enterprise-wide awareness and training program is utilized to mitigate risks by educating users on their role in combating security breaches, following good security practices, and maintaining awareness of security risks associated with their actions. This program includes mandatory and optional activities inclusive of online training, presentations, newsletters, blog posts, and simulation exercises.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: We identify, assess and manage material risks from cybersecurity threats through our GIS Program as follows: • We deploy a defense-in-depth strategy, acknowledging the importance of people, processes and technology in upholding information security. The strategy incorporates multiple layers of controls, including, monitoring, vulnerability management, identity and access management and security assessments. • Our program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST) and other technical standards and frameworks. • We have a robust cybersecurity defense response plan that provides a documented framework for handling security incidents and facilitates coordination across multiple parts of the company. • We invest in threat intelligence and operate a state-of-the-art Cyber Defense Center, which acts as our hub of information sharing and threat intelligence analysis. • We incorporate external expertise and reviews into our cybersecurity risk management program and continue to engage a leading professional consulting firm to assist our company in incorporating cybersecurity best practices. • We provide annual cybersecurity awareness and ongoing phishing training, such as routinely performing cybersecurity attack simulation exercises, which includes participation from various levels of management. • Following a risk-based approach, we conduct due diligence reviews of our third party providers for potential cybersecurity risks to the company. Our Enterprise Risk Management (ERM) team oversees our Third Party Risk Management (TPRM) program, which partners with our GIS, Information Governance, and Operational Resilience groups to manage and monitor third party risk of CME Group vendors and certain third parties of customers (fourth parties). The teams monitor cyber-related incidents and known third party vulnerabilities with the goal of enhancing processes, improving risk management and partnering on exit planning and testing for certain vendors associated with essential functions. • We have insurance against certain cybersecurity and privacy risks and attacks. • We are an active participant in the financial services industry and government forums and information sharing programs, designed to improve both internal and sector cybersecurity defense. These valuable external partnerships are established and maintained in order to gain more timely, comprehensive and actionable threat information across geographies and industries and to facilitate the exchange of best practices and security techniques. They allow for a high degree of collaboration and cooperation with local, state, federal, and international law enforcement and intelligence agencies, industry groups, and other private sector chief information security officers. • We regularly test the design and effectiveness of our information security controls and processes through a program of testing performed by internal and independent third-party teams. Gaps and opportunities identified through testing are assigned to certain members of management and tracked through to closure. Testing activities support a variety of regulatory requirements and external industry certifications held by CME Group.

companyName: CME GROUP INC.

ticker: CME


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business Operations," which disclosures are incorporated by reference herein.

companyName: Molecular Templates, Inc.


text: The Company actively monitors and evaluates threats, events, and the performance of its business operations and continually adapts its risk mitigation activities accordingly. To that end, the Company maintains a comprehensive vulnerability management program that includes regular internal scans of the entire network to identify and measure the severity of security vulnerabilities, a team of dedicated network engineers who are responsible for fixing identified vulnerabilities within pre-defined timeframes based on severity, and at least annual independent network penetration testing by a qualified third party.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. We also perform periodic due diligence reviews for existing third-party service providers based on the risks identified in the initial review, or if events and circumstances necessitate a review.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics from our Chief Information Officer. The Committee reports to the full Board of Trustees regarding its activities, including those related to cybersecurity. The full Board of Trustees also receives briefings from management on cybersecurity matters as needed.

companyName: VORNADO REALTY LP


text: Senior management has appointed a Cybersecurity Council that is responsible for identifying, escalating, and facilitating the assessment and determination of the materiality of cybersecurity incidents and threats. The Cybersecurity Council is made up of representatives of IT, Legal and Finance, as well as ad hoc additional members depending on the circumstances of the incident or threat. The members of the Cybersecurity Council do not have specific expertise in cybersecurity risk other than the VP IT who has more than 20 years of experience, and engages with trusted third-party experts for support and guidance when additional expertise is required. Prior to joining Codexis, our VP IT has managed cybersecurity functions, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters.

companyName: CODEXIS, INC.

ticker: CDXS


text: The Board is responsible for overseeing our enterprise risk management program. The Audit Committee of the Board has been designated by the Board to oversee cybersecurity risks and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee receives updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer.

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including, but not limited to: consultants who assist with assessing risks, assess of our systems alignment with NIST Cybersecurity Framework, FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.

companyName: RBB Bancorp

ticker: RBB


text: Management updates our board of directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: The management team includes members with IT backgrounds and relevant experience to guide our cybersecurity efforts. Management ensures that employees are provided with adequate resources and training to fully understand cybersecurity guidelines and expectations. In the event of a Policy breach, members of the management team may be asked by the IT Department to assist with security investigations. If any member of management is unaware of the best course of action in dealing with an IT-related matter, the manager shall immediately contact the Company's third-party IT representative. Upon discovering a potential violation of the Policy or a cybersecurity breach, the member of management must document the incident and request the individual surrender possession of any devices that may have suffered a security breach.

companyName: Cosmos Health Inc.

ticker: COSM


text: As part of our cybersecurity program, we have adopted an incident response plan, under which the Chairs of our Board of Directors and Audit Committee are informed by the Cybersecurity Steering Committee of any cybersecurity incidents that have the potential to materially adversely impact the Company or its information systems. To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, or in any penalties or settlements.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: Our CIO is accountable for the Firm's cybersecurity and data privacy programs and is supported by the CISO. Our CIO and CISO have over 35 and 25 years, respectively, of experience in information security and program management, and have both served over 10 years in our corporate information security organization. Under the guidance of the CIO, the CISO manages day-to-day operations of the security and data privacy functions and proposes changes to the Firm's cybersecurity strategy, which is part of our overall information technology strategy. The CIO and CISO meet frequently to discuss cyber and data operations, privacy programs and risks. Each of these teams remain in close coordination to ensure risk mitigation strategies are designed and operating effectively.

companyName: KFORCE INC

ticker: KFRC


text: Identify. We use several methods to identify cybersecurity events, including, but not limited to, security alert tools, log monitoring by systems engineers working on operational incidents that are later determined to be security incidents, or suspicious activity reported directly by employees. Cars Commerce has developed security incident response procedures to (1) assess cybersecurity incidents, (2) identify and implement containment measures, (3) preserve evidence, (4) log response activities and (5) determine corrective actions to prevent similar incidents.

companyName: Cars.com Inc.

ticker: CARS


text: Regular meetings are conducted with IT service providers to assess compliance with contracted services, which includes a report on detected information security and cybersecurity incidents, activities for their remediation, and findings and insights from previous reviews and improvements.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: The Risk Committee of the Board has oversight of the Bank's Risk Management Program, which includes risks from cybersecurity threats within cybersecurity risk management. The Technology Committee of the Board has responsibility for the strategic design, direction and oversight of the Bank's information and cybersecurity program.

companyName: Federal Home Loan Bank of New York


text: In an effort to deter and detect cybersecurity threats, we require all employees who use an official company email account to conduct business to complete regular data protection and cybersecurity trainings, which cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting potential incidents immediately. We also use technology-based tools to mitigate risks from cybersecurity threats.

companyName: KADANT INC

ticker: KAI


text: Our Board of Directors has ultimate oversight of cybersecurity and information security risk, which it manages as part of our enterprise risk management program. The Board is assisted by the Audit Committee,,as it pertains to cybersecurity threats to the integrity of the Company's financial systems and compliance with cybersecurity related disclosures, and the Sustainability and Risk Committee, as it pertains to cybersecurity as a part of the Company's enterprise risk, which oversee our cybersecurity risk exposures, review management's mitigation efforts, and report their findings to the Board. Throughout the year, our senior executives, including our Chief Information Security Officer ("CISO"), provide regular briefings to the full Board, the Audit Committee and the Sustainability and Risk Committee. These updates cover technology trends, regulatory developments, disclosure requirements, legal issues, policies and practices, threat environment assessments, and ongoing security measures to prevent, detect, and respond to critical threats. The Board and its committees regularly engage in discussions with senior executives regarding cybersecurity and information security risks. As part of our cybersecurity governance, we also maintain a Cybersecurity Steering Committee chaired by our CISO and comprised of executive management, operational leaders, and cross-functional teams. Generally, this committee meets quarterly, or more frequently as needed, to review, assess and direct decisions related to cybersecurity and information systems matters.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: COO provides updates to the CEO and escalates material issues to the Audit Committee as needed. Management's expertise is further enhanced through ongoing professional development and participation in industry forums to stay abreast of evolving threats. Industrial Corp is committed to timely and transparent disclosure of material cybersecurity incidents as required by SEC regulations. In the fiscal year ended December 31, 2024, we did not experience any cybersecurity incidents.

companyName: Quality Industrial Corp.

ticker: QIND


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company ' s Business and Operations, which disclosures are incorporated by reference herein.

companyName: CervoMed Inc.

ticker: CRVO


text: Members of management, including our Chief Legal Officer, regularly report on the company's cybersecurity matters to our board's Audit Committee. The Audit Committee has been assigned the responsibility for reviewing and discussing with management the company's major operational, legal and regulatory risks, including data security and privacy and the company's policies to identify and manage cybersecurity risks.

companyName: Zumiez Inc

ticker: ZUMZ


text: Our Information Security team is responsible for managing all reported cybersecurity threats until final resolution. We maintain a record of reported cybersecurity incidents and the management and resolution of such incidents.

companyName: EQT Corp

ticker: EQT


text: As part of its overall Enterprise Risk Management ("ERM") program, the Company identifies and assesses cybersecurity risks on an annual basis. These assessments are integrated into the Company's cybersecurity program to ensure alignment with broader risk management objectives. The ERM program includes identification, assessment and management of risks, including cybersecurity risks. Business process owners incorporate risk management philosophy, exposures, mitigating activities, and key indicators to develop strategies and actions. The ERM Steering Committee, comprised of senior level executives, is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation actions, and assisting the Board of Directors in overseeing the Company's cybersecurity risks.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: The Company's technology staff and CISO conduct weekly meetings, attended regularly by the Chief Operating Officer and Chief Information Officer, to review: (i) implementation of new security measures, (ii) results of existing technical system monitoring tools to identify any potential risk and propose remediation, as necessary; (iii) newly disclosed software patch updates to assess risks and set patch implementation priorities; and (iv) threat intelligence from various organizations, such as the Cybersecurity and Infrastructure Security Agency, to assess risks and suggest security measures, as necessary. Cybersecurity risk is also included in the Company's Enterprise Risk Management ("ERM") process that involves senior management and other personnel in the identification, assessment and management of a broad range of risks (including cybersecurity risks) that could affect the Company's ability to execute on its corporate strategy and fulfill its business objectives. The Company's Chief Operating Officer and Chief Information Officer provide input and updates to the Enterprise Risk Committee (comprised of members of management) on cybersecurity preparedness and emerging risks. The Enterprise Risk Committee produces the relevant risk management information for executive and senior management and the Board of Directors, which receives ERM updates on a quarterly basis. The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: To date, we have not experienced any cybersecurity incidents that have materially affected our business, operations, or financial condition. As our operations evolve, we may consider implementing additional cybersecurity measures as appropriate for the size and complexity of our business.

companyName: Bodhi Tree Biotechnology Inc

ticker: BDTB


text: Key elements of our cybersecurity risk management program include: • The formalization and implementation of enterprise-wide IT and Information Security Policies which include encryption standards, antivirus protection, vulnerability management and reporting, multifactor authentication, granting and removing of access, confidential information, credential standards, and the baseline hardening of devices; • Conducting vulnerability assessments and penetration tests; • Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system; • Revision of user access request documentation to clearly define the roles and permissions assigned to users; • Thorough review of the accuracy and completeness of user listings and access; • Monthly evaluations to identify and assess cybersecurity risk to our enterprise information technology environment; • Continued collaboration with external specialists to aid in the ongoing evaluation of existing policies and assess, test or otherwise assist with aspects of our security controls; and • General cybersecurity training for all employees and role-based specialized training for certain roles to enhance the awareness of shared responsibility for cybersecurity risk management.

companyName: Manitex International, Inc.


text: Our IRPs, which are tailored to address potential cybersecurity threats in both our product and corporate infrastructure technology environments, are designed to provide a comprehensive, structured response to cybersecurity incidents, and apply to all MicroStrategy personnel, including employees, directors, temporary staff, and contractors. In accordance with our IRPs, we train our personnel to report any cybersecurity incidents to our Information Security Team (IST). Upon identification of a cybersecurity incident, the IRPs mandate that the IST conduct an immediate evaluation and assign a severity rating to the incident and, depending on the severity, report the incident to our Chief Information Security Officer (CISO). Based on the severity of the incident, a Security Incident Response Team (SIRT), the members of which include our Chief Information Officer (CIO), the CISO, and personnel from various departments, including legal, is convened. The SIRT, with assistance from the IST, is tasked with executing a timely and effective response to the incident, and SIRT members are assigned specific roles and responsibilities, including assessment of the incident's materiality for disclosure purposes.

companyName: Strategy Inc

ticker: MSTR


text: Our Information Technology (IT) department and Senior Director of IT, with the assistance of our legal department, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: The cybersecurity operations team is responsible for cyber threat detection, investigation and response. We leverage a managed security service provider to monitor key system and network activity on a 24/7/365 basis and to detect and alert the cyber security operations team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources.

companyName: SANDY SPRING BANCORP INC


text: See Item 1A—Risk Factors above for additional discussion of various risks related to cybersecurity that are reasonably likely to have a material impact on our company, including our business strategy, results of operations or financial condition.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: We maintain continuous and near-real-time security monitoring of the AT&T network for investigation, action and response to network security events. This security monitoring leverages tools, where available, such as near-real-time data correlation, situational awareness reporting, active incident investigation, case management, trend analysis and predictive security alerting. We assess, identify and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests and engaging third parties to conduct analyses of our information security program. When circumstances warrant, we also retain external cybersecurity experts to assist the CSO. We conduct vulnerability testing and assess identified vulnerabilities for severity, the potential impact to AT&T and our customers, and likelihood of occurrence. We regularly evaluate security controls to maintain their functionality in accordance with security policy. We also obtain cybersecurity threat intelligence from recognized forums, third parties and other sources as part of our risk assessment process. In addition, as a critical infrastructure entity, we collaborate AT&T Inc.

companyName: AT&T INC.

ticker: T


text: We provide regular, mandatory training, including ongoing end-user security awareness training and attack simulation assessments, for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Shockwave Medical, Inc.


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity and availability of our critical systems and information. At any given time, we face cybersecurity risks and threats, some of which are not fully mitigated, and we routinely address newly discovered vulnerabilities. We continuously work to enhance our information security program and risk management efforts. Our program includes processes for identifying, assessing and managing material risks from cybersecurity threats that are guided by the National Institute of Standards & Technology's Cybersecurity Framework, the ISO 27001 international standard for information security and other applicable industry benchmarks.

companyName: Broadcom Inc.

ticker: AVGO


text: We have not experienced a cybersecurity incident that would materially affect the company's business strategy, results of operations or financial position.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Blackstone's Legal and Compliance.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: These processes are designed to prevent cybersecurity incidents, but also allows our organization to quickly detect and respond to incidents if they do occur. They are regularly reviewed and updated to adapt to evolving cybersecurity threats.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Cybersecurity risks are a growing threat to us and other businesses, including our ERP and other third-party providers, which are vulnerable to cyberattacks, malware, and other system failures that may result in unauthorized access, damage, and other harms to our business or reputation. Protecting the confidentiality, integrity, and availability of our business information, intellectual property, customer, patient and employee data, and technology systems is critical to our business and operations, ability to comply with regulatory requirements, and reputation.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: Governance and Oversight Bio-Techne's cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"), with day-to-day management and administration of our cybersecurity program performed by the IT Security Operations team. The CISO reports to the Chief Information Officer ("CIO"), and the CIO reports to the Chief Executive Officer. The CISO is supported by the Incident Response Team ("IRT"), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions. The IRT supports the CISO and CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation. In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team. All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises with a focus on roles and functions with access to sensitive company and financial information. We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.

companyName: BIO-TECHNE Corp

ticker: TECH


text: We, in coordination with external experts, have implemented a cyber and data security incident response plan that has four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) identification, analysis, and notification of a security incident by external experts, as applicable, 3) containment, eradication, and recovery, and 4) post-incident analysis and learnings for future preparedness. Such incident responses are managed by our outsourced IT managed services provider, Chief Financial Officer ("CFO"), and department managers, who, together, comprise our primary incident response team. As part of our cybersecurity risk management process, our incident response team logs and tracks privacy and security incidents across the Partnership, vendors, third party service providers, and other business partners. Cyber and data security incidents are evaluated to determine materiality, as well as operational, business, and privacy impact, ranked by severity, and prioritized for response and remediation. Significant incidents are evaluated by the primary incident response team to determine whether further escalation is appropriate, and any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to the Chief Executive Officer ("CEO"). We consult with outside counsel and other subject matter experts regarding materiality analysis, disclosure, and other compliance matters, as appropriate, and our executive officers, with input from the Board of Managers, as appropriate, make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Partnership's independent public accounting firm of matters and any relevant developments.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: While management is responsible for assessing and managing our day-to-day risks and control systems, the Audit Committee of the Board oversees our information technology and cybersecurity risks. The Committee conducts a comprehensive review of cybersecurity topics and reviews our programs and practices with management at least annually, and receives management's report on our cybersecurity dashboard, which summarizes key security metrics and activities, at each quarterly Committee meeting.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Vice President, Cybersecurity and includes our Chief Human Resources Officer, Vice President, Privacy, senior personnel from our legal, finance, and relevant business departments (the "Incident Management Team"). Our Vice President, Cybersecurity brings extensive experience in software development, IT, and cyber security, gained in over two decades in the telecommunications, financial services, defense, and healthcare sectors. Notably, he spent the last four years at a medical device company focused on insulin delivery, where he successfully established the product security program and played a pivotal role in obtaining clearance for its flagship product line.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. The Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that the Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: Palisades Venture Inc.


text: As part of the cybersecurity risk management program, the Company has a set of Company-wide cybersecurity policies and procedures, including an Acceptable Use Policy as well as other policies covering subjects such as Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Media Protection, System and Communications Protection, and Incident Response. These policies and procedures go through an internal review process and are approved by appropriate members of management. The Company requires all personnel, including contingent workers and business partners handling information on the Company's behalf to follow its cybersecurity policies and procedures. Regular training modules educate the Company's team members on relevant cyber threats and trends and help prepare them for real-life phishing threats.

companyName: OSHKOSH CORP

ticker: OSK


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: ARVINAS, INC.

ticker: ARVN


text: The IT Security Steering Committee, which is in charge of our cybersecurity policies and procedures, including the ones discussed in "Risk Management and Strategy" above, is led by our Chief Financial Officer, who has nine years of senior leadership experience at public biotechnology companies, including six years with 89bio. The IT Security Steering committee also includes our Director of IT, who is an experienced Information Technology professional and has over 20 years of experience managing information technology, of which more than 10 years pertain to cybersecurity related experience.

companyName: 89bio, Inc.


text: TEC's Vendor Risk Management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. TEC also has requirements for third-party service providers which include regulatory compliance and meeting the National Institute of Standards and Technology Cybersecurity Framework policy and standards. TEC's processes also provide for mitigating cybersecurity risk from third parties through seeking to include in its agreements with third-party service providers, as applicable, cybersecurity provisions designed to appropriately address such risks.

companyName: TAMPA ELECTRIC CO


text: The Bank's IT Security Program and policies establish safeguards to protect data and information that is used by the Bank's employees, independent contractors, and vendors. The goal of the Bank's cybersecurity risk management processes is to maintain and safeguard the confidentiality and integrity of the Bank's data, and to ensure system availability to protect against cybersecurity threats and vulnerabilities. The Bank maintains IT security policies that are reviewed at least annually and approved by the Bank's Chief Information Officer ("CIO"), appropriate management committees and, for its critical policies, the Bank's Board of Directors. To help ensure the effectiveness of the Bank's IT security policies, all employees are required to participate in annual IT security training and to review and acknowledge the Bank's IT security policies.

companyName: Federal Home Loan Bank of Dallas


text: Our Information Security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and audits of our systems and conducts enhanced training for specialized personnel. We also conduct cyber awareness training and simulate responses to cybersecurity incidents and use the findings to improve our practices, procedures, and technologies. The Company provides security awareness education and training for all employees and consultants, conducts monthly internal "phishing" testing and mandatory training for "clickers," and publishes periodic cybersecurity newsletters to highlight any emerging or urgent security threats.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Our chief financial officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.

companyName: CVRx, Inc.

ticker: CVRX


text: At the management level, the CIO and CSO receive regular reports from the company's cybersecurity department, both historical and real-time, about the company's global cybersecurity status. The company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). If management determines a material cybersecurity incident has occurred, the company's policies require management to promptly inform the Board.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: We have established a risk assessment methodology that includes requirements for treatment plans, risk acceptance thresholds, prioritization, and control analysis, as well as likelihood and impact analysis. A risk assessment is performed annually. Treatment plans are monitored and reported to management on a quarterly basis. Cybersecurity and risk management are shared responsibilities that apply to the Infinera team across all levels of the organization.

companyName: Infinera Corp


text: As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our security measures, we cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For further discussion, please see the risk factors titled "Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "We are highly dependent on information and communication systems and system failures and other operational disruptions could significantly disrupt our business, which may, in turn, materially adversely affect our business, financial condition and results of operations and our ability to make distributions to our stockholders" in Part I, Item "1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: Through third-party service providers and attendance at seminars, the Vice President of IT and Digital and CISO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes to identify, prevent, mitigate and remediate of cybersecurity threats and cybersecurity incidents.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Cybersecurity is a complex and constantly evolving risk that we are committed to understanding and mitigating. The foundation of our information security practices is rooted in the principles set forth by the National Institute of Standards and Technology ("NIST"), ensuring a robust and comprehensive approach to safeguarding our digital assets. This program provides standards, guidelines, and best practices for improving our cybersecurity risk management. To effectively manage our cybersecurity risk, we employ a comprehensive approach encompassing risk assessment, identification, and mitigation, all aligned with the rigorous standards and principles. Cybersecurity and IT compliance risk metrics are monitored regularly to assess, identify, manage and protect our environment. Periodic audits of IT and Cybersecurity are carried out as part of internal and external audits and are performed by professionals.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Collab Z Inc.

ticker: CLBZ


text: The Company also maintains coverage under a cyber security insurance policy. Levels of coverage are reviewed periodically to ensure alignment with the organization's risk appetite.

companyName: FB Financial Corp

ticker: FBK


text: Cybersecurity training is a key component of annual employee training and is conducted through the year utilizing different methods such as training sessions with the CIO, on-demand third-party cybersecurity and phishing exercise campaigns, and periodic third-party-conducted social engineering testing.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Our Board considers cybersecurity risks as part of its risk oversight function of cybersecurity and other information technology risks.

companyName: DIH HOLDING US, INC.


text: The importance of cybersecurity is conveyed internally within the organization as well as externally. Within the organization, our cybersecurity efforts are led by our Information Technology ("IT") Manager who is a Microsoft Certified Professional and holds CompTIA Network+ and Cisco Network certifications. We have also established an IT steering committee consisting of members from various key departments including IT, Finance, Operations, and Human Resources. The IT steering committee convenes at regular periodic intervals and reviews IT strategic and investment priorities, including the Company's cybersecurity programs. Our policies also require each of our employees to contribute to our data security efforts. At least annually, employees are required to attend a mandatory training on how to recognize phishing attempts and how to best handle and report cybersecurity threats.

companyName: Karat Packaging Inc.

ticker: KRT


text: Our cybersecurity strategy is designed to protect the confidentiality of our data from unauthorized access, the integrity of information throughout its lifecycle, and the availability of that information and the related systems. Our strategy is guided by the National Institute of Standards and Technology Cybersecurity Framework, which helps us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Western Union CO

ticker: WU