text: Our Board of Directors and its committees play an active role in overseeing our key risks. Our cybersecurity risk management processes and strategy are governed by the Audit Committee of our Board of Directors. Management provides quarterly reports to the Audit Committee that include, among other items: 1) AAM's cybersecurity scorecard, which includes certain key performance indicators (KPIs) and provides quantitative measures of these KPIs; 2) industry security trends and outlook; 3) an update on AAM's security program and roadmap; 4) current quarter IT security accomplishments; and 5) IT security priorities for the following quarter. In addition, on an annual basis, management reports to the Audit Committee the results of our system availability and disaster recovery testing for AAM's enterprise systems, as well as the results of our incident response testing and corresponding action plans.

companyName: Dauch Corp

ticker: DCH


text: Cybersecurity risks are integrated into our enterprise risk management ("ERM") program, which evaluates cybersecurity risks alongside other company risks as part of a quarterly and ongoing process designed to identify, assess and manage risk exposures over the short-, intermediate- and long-term. In addition, our management-level Information and Technology Risk Oversight Committee ("ITROC"), led by our CISO, and including senior leaders such as our President and COO, CFO and General Counsel, among others, provides oversight relating to cybersecurity and technology-related risks that may present significant impacts to our operations, clients, reputation and financial position, and the considerations of the ITROC are fully incorporated into our overall ERM framework. Our CISO also provides updates to our Disclosure Committee on material cybersecurity incidents.

companyName: MSCI Inc.

ticker: MSCI

secItem: Item 1C


text: Our Written Information Security Program ("WISP"), which is our enterprise information security and cybersecurity program incorporated in our ERM program and led by our Chief Information Security Officer ("CISO"), is designed to (i) ensure the security, confidentiality, integrity, and availability of our information and information systems (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity, or availability of such information and information systems and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our associates, or our clients. The WISP program is built upon a foundation of advanced security technology, employs a highly trained team of experts, and is designed to operate in alignment with global regulatory requirements. The program deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to, and recover from information security and cybersecurity incidents. Those controls are measured and monitored by a combination of subject matter experts and a security operations center with integrated cyber detection, response, and recovery capabilities. The WISP program includes our Incident Response program, which manages information security incidents involving compromises of sensitive information, and our Security Incident Response Plan, which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills around security matters at both a technical and management level, and our associates receive annual cybersecurity awareness training.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer and General Counsel.

companyName: LendingTree, Inc.

ticker: TREE


text: The Corporation also addresses cyber risks posed by its relationships with third-party vendors. The Corporation assesses vendor risk as a part of its vendor management process, which requires a pre-acquisition diligence review, including the review of the vendor's information security policy for all vendors determined to be a "critical vendor". The vendor management process also requires a review of all critical vendors annually and all critical vendors are reported to the Board of Directors.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: The IT Security team is led by the CISO. The CISO reports to the CIO who, in turn, reports to the Executive Chairman and Chief Executive Officer. The CISO has 40 years of IT experience, with over 20 of those focused on IT security functions and strategies. Collectively, the other members of the IT Security Team have decades of relevant education and experience and maintain a wide range of industry certifications. Cybersecurity training is provided for the IT Security Team upon joining the IT Security Team, on an annual basis and more frequently when necessary.

companyName: EASTMAN KODAK CO

ticker: KODK


text: As dictated by the incident response plan, our audit committee also will receive prompt and timely information regarding cybersecurity threats or incidents that may be material in nature from the incident response team, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: •"—Cybersecurity breaches or threats or other unauthorized access or attempts to access to our systems could compromise the security of our systems and otherwise disrupt our normal operations which could have a material adverse effect on our business, results of operations and financial condition," and •"—Our independent, third-party authorized dealers may not be able to mitigate certain risks such as information technology breaches, data security breaches, product liability, errors and omissions, and marketing compliance".

companyName: ADT Inc.

ticker: ADT


text: Accordingly, the Company has devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, as noted below:

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessments; and to audit and provide advice on how to make its security processes and controls more effective.

companyName: ULTRALIFE CORP

ticker: ULBI


text: The Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Vice President of IT or the Chief Legal Officer as described below in "Management's Role Managing Risk."

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: The Company's management is responsible for identifying, assessing, and managing the Company's exposure to cybersecurity risk. The Company has an internal team that is supported by security technologies, third-party experts, and threat intelligence resources in support of cybersecurity risk reduction. The Company's internal cybersecurity team is led by the Company's Director of Information Security and Compliance, who acts in the capacity of a chief information security officer and is responsible for overseeing the execution of cybersecurity strategy and maturing the Company's cybersecurity posture. The Director of Information Security and Compliance reports to the Company's Vice President of IT Services and has education, training, and experience pertinent to cybersecurity, including more than 25 years of IT experience with over 15 years in Information Security and holds the Certified Information Security Systems Professional (CISSP) certification.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Cybersecurity Risks Like other complex corporations, Reliance is the target of cyber-attacks from time to time. However, since January 1, 2021 (the first date covered by the financial statements presented in this Form 10-K) we have not experienced any cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, please see the risk factor set forth under the caption Item 1A. "Risk Factors" the Risk Factor captioned " We rely on information management systems and any damage, interruption or compromise of our information technology management systems, networks or data could disrupt and harm our business."

companyName: RELIANCE, INC.

ticker: RS


text: Monitoring of Cybersecurity Incidents The Cybersecurity Director implements and oversees our processes for regularly monitoring our information systems. This includes security measures and regular audits to identify potential issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the Cybersecurity Director or their designee, who in turn oversees our assessment of and response to the incident. The Cybersecurity Director is also responsible for informing the Risk Committee of cybersecurity incidents, which in turn has a detailed process for assessing the impacts of incidents and monitoring the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notification to senior executives, including the Chair, President, and Chief Executive Officer, the Executive Vice President of Business Services and General Counsel and to the Board of Directors.

companyName: NUCOR CORP

ticker: NUE


text: Our Board of Directors is responsible for monitoring and assessing the Company's cybersecurity risk management as part of its overall responsibility of risk oversight. The Board's Audit Committee is responsible for overseeing risks related to our accounting, financial statements and financial reporting process, including the Company's cybersecurity incident materiality assessment and relevant disclosures. For more information, see Part III, Item 11, "Board's Role in Risk Oversight."

companyName: OPEN TEXT CORP

ticker: OTEX


text: We have implemented a Vendor Cybersecurity Risk Management Program ("VCRMP"), which is within the scope of our ISO 27001 certifications. The VCRMP controls are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in making these risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Addressing cybersecurity risks is a priority for us. We have in place systems of internal controls as well as business continuity and disaster recovery plans, and we regularly perform assessments of these systems and plans to address cybersecurity and technology. Our cybersecurity program has been developed based on industry standards set by the National Institute of Standards and Technology ("NIST") and includes a comprehensive set of security policies and procedures which guide our protection strategy against threats by utilizing the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls, and remediation practices; implementing a third-party risk management program to evaluate our cyber position; and, evaluating our cybersecurity program effectiveness by auditing risk and performing both internal and external testing. In addition to a dedicated information technology cybersecurity team monitoring our daily operations, we annually assess our cybersecurity program against the NIST framework and engage outside security firms to conduct penetration tests and assist with monitoring of daily operations. We require annual cybersecurity awareness training for all of our employees to aid in promptly identifying and reporting potential or actual issues. Additionally, our dedicated information technology cybersecurity team undertakes regular robust cybersecurity training to increase cybersecurity awareness, internal expertise, and readiness efforts. We install and regularly update antivirus software on all Company managed systems and workstations in an effort to detect and prevent malicious code. We conduct ongoing security breach and phishing simulations to raise awareness of various critical security threats. Periodically, we run tabletop exercises involving members of the Company's management team intended to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures. In addition to these procedures we have in place, we also maintain cybersecurity insurance to cover certain losses and damages caused by a cybersecurity incident. All third-party service providers or vendors utilized as part of the Company's cybersecurity framework are required to comply with our policies regarding non-public personal information and information security.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: We recognize the importance cybersecurity has to the success of our business. We also recognize the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including customer records and information, against known and evolving cybersecurity threats.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Education and Awareness The Company regularly conducts mandatory cybersecurity training for its employees, and all new hires are required to take cybersecurity training when they receive their Company computer. Failure to complete the training in a timely fashion results in their system access being suspended until completion. Management also regularly conducts "phishing" exercises to test the effectiveness of our training programs. The results of these exercises are reported to the Audit Committee. Employees also receive monthly newsletters highlighting cybersecurity developments as well as targeted email messages, as appropriate.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: We utilize third-party service providers to manage portions of our business operations. We have established processes to review, identify and manage cybersecurity risks associated with the use of service providers. Prior to engaging these providers, we review the providers' SOC 2 Type II or other relevant security audit reports to ensure proper security controls are in place. We evaluate the service providers' controls for incident response strategy to identify any significant risks and adapt accordingly. We systematically review these assessments for any significant change throughout the relationship. Our risk management program consistently monitors for risk to our systems and services presented by these service providers and promotes strategies to address any threats identified.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Cybersecurity Risks Associated With Cybersecurity Threats While we have been subject to a number of cybersecurity threats and experienced non-material incidents in the past, as of the date of this Annual Report, they have not had a material adverse effect on our business, financial condition or results of operations. Our third-party service providers have also been subject to a number of cybersecurity threats and incidents, but to date, none of those threats and incidents have had a materially adverse effect on our business, financial condition, or results of operations.

companyName: Compass, Inc.

ticker: COMP


text: Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks as well as engage with various third parties to assist in program development, risk evaluation and testing. Our cybersecurity program is predicated on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). At minimum, on an annual basis we measure ourselves against this framework and use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our strategic execution. W e have also implemented a third-party risk assessment process for certain service providers, suppliers, and vendors, which is conducted during the procurement cycle. Critical vendors are assessed on an annual basis. In addition, all team members are required to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Our Chief Information Officer and his team are responsible for leading our cybersecurity strategy, policy, standards, architecture, and processes. Our information security leadership team has more than 20 years of combined experience in cyber and information security matters. Our information security program is also supported by our Chief Compliance Officer and other members of senior management. We conduct periodic reviews of our program by internal and external experts with the results of those reviews reported to senior management and the Board. Moreover, the Audit Committee of our Board (the "Audit Committee") reviews our cybersecurity matters with our Chief Information Officer at each of its quarterly meetings. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners. For example, we require certain third-party service providers and other business partners to provide us with SOC II reports that demonstrate alignment with security standards. We also actively engage with industry participants as part of our continuing efforts to evolve our cybersecurity governance.

companyName: Monster Beverage Corp

ticker: MNST


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees the day-to-day security operation, and our Chief Information Officer ("CIO") oversees our secure development activities.

companyName: CORVEL CORP

ticker: CRVL


text: We partner with leading cybersecurity companies and organizations to enhance our cybersecurity infrastructure, leveraging third-party technology and expertise to monitor and optimize the performance of deployed products and services. We also engage with third party firms to help identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards and best practices. We use a third-party provider to supplement the continuous monitoring of our cybersecurity environment and to help coordinate the investigation and remediation of events. Our incident response plan documents the procedures for assessing and managing cybersecurity events, including steps for identifying the nature of a cybersecurity threat (including whether the threat is associated with a third-party provider), as well as assessing the severity of a cybersecurity threat. Our incident response team includes executives, and any material cybersecurity events are reported to our Board. In addition, employees are provided with online training courses to build awareness around potential cybersecurity scams and are tested periodically to maintain their focus in this important area.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: The Audit Committee receives regular presentations and reports from our Chief Technology Officer on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.

companyName: Champion Homes, Inc.

ticker: SKY


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our processes and policies related to cybersecurity are focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident, and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall enterprise risk management systems and processes. For example, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: As of the date of this report, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Corporation, including its business strategy, results of operations or financial condition. Although the Corporation has mature processes in place to identify and mitigate potential risks from cybersecurity threats, such risks cannot be completely eliminated. More information on the risks of cybersecurity threats and potential impact to the Corporation can be found in Item 1A. Risk Factors.

companyName: UNION CARBIDE CORP /NEW/


text: As part of the ongoing maintenance and development of our IS Program, we assess the various risks associated with the unauthorized access or loss of client information and the quality of security controls as prescribed by the Federal Financial Institutions Examinations Council and several other frameworks. The frameworks and our IS risk assessments are utilized to monitor and develop strategies to minimize risk to our information assets.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Within our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company and third-party service providers. Significant incidents undergo review by a cross-functional group, with immediate escalation for potentially material incidents. We consult with outside counsel as needed, with final decisions made by senior management.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: We also maintain a written Cyber Security Policy that establishes a framework for how we respond to data breaches, cyber attacks, and other security incidents, and discusses our employees' obligations with respect thereto. We maintain additional policies, including regarding the establishment of physical and environmental security requirements for protection of our information assets and security measures taken to protect privileged accounts with access to critical resources, sensitive data, and system configurations. Further, we have adopted a Cyber Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to responding to, containing, investigating, documenting, and mitigating incidents.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: The Risk Committee, chaired by a former senior executive from KPMG LLP, who established and led KPMG's Financial Risk Management practice in the U.S., annually evaluates the effectiveness of the Company's cybersecurity controls.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: Our Cybersecurity Program Our products and services are normally classified as EAR 99 (items not designated under the control) by the U.S. government, but our defense customers may ask us to make some alterations for the environments in which the products will be used. Moreover, our products sold for defense applications are integrated with our customers' products. Given the nature of our business and the cybersecurity risks we face, we have instituted a cybersecurity program for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats to our internal systems, our products, services and programs for customers, and our supply chain.

companyName: Vuzix Corp

ticker: VUZI


text: Awareness and Training for Employees: We conduct regular phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats. These initiatives aim to enhance employee awareness and preparedness against potential cyber threats.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees and is regularly updated on management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks.

companyName: SIMON PROPERTY GROUP L P


text: We also employ the use of Secure Socket Layer inspection on our firewalls, which are able to decrypt and scan all network traffic entering and leaving our facilities. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, including regularly reviewing and updating our incident response plan. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: Our advisor has formed a Cyber Governance Committee ("CGC"), comprised of our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer (also our Chairman of the Board of Directors) and our advisor's Chief Financial Officer (also our Chief Financial Officer) material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Our security officer has over a decade of management and executive level information technology experience and reports to our SVP of Engineering and Technology. Our security officer is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, SVP of Engineering and Technology, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies. Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters. Where in the past we leveraged an outside fractional Chief Information Security Officer ("CISO"), during the year we transitioned to an in-house security leadership team. Our team includes personnel for supply chain security, governance risk and compliance and security engineering. We continue to leverage external industry partners in key areas including penetration testing, forensics, and for our security operations center. We use industry standard security tools across our program and reevaluate these annually as we digest the evolving threat landscape.

companyName: IonQ, Inc.

ticker: IONQ


text: Cybersecurity awareness training for employees and supplemental training for senior management and other personnel who access highly sensitive information A third-party risk management process and questionnaire for service providers and vendors who access sensitive information. A trained incident response team and written procedures to navigate the incident response lifecycle.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: Our cybersecurity framework (which includes management of related risks), is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We do not certify that we meet any particular technical standards, specifications, or requirements, but we use the aforementioned frameworks and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We use these frameworks, together with information collected from internal assessments, to develop policies for the use of our information assets (e.g., IT business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, by strong Identity and Access Management framework, such as Role Based Access Control, Attribute Based Access Control, principle of Least Privilege, Need-to-Know access and multi factor authentication as obligatory second factor to our core resources. We also enhance our endpoint protection by deploying an endpoint detection and response tool. Its core mission is to defend our endpoints and systems against new malware, rootkits, spywares and ransomware. We also work with internal stakeholders across the Company to integrate foundational cybersecurity principles throughout our operations, including the employment of multiple layers of cybersecurity defenses, restricted access based on business needs, and integrity of our business information. We routinely train our employees on cybersecurity awareness on social engineering attacks, confidential information protection, emerging threats and simulated phishing attacks to improve self-awareness of our employees.

companyName: Zedge, Inc.

ticker: ZDGE


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our cybersecurity program follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure that our cybersecurity risks fully integrate into the Company's overall risk management approach.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: Each of ITUS and ITEU report to their respective segment Chief Executive Officers, Messrs. Madar for ITUS and Benacin for ITEU, who are also directors of our Company. Any material issues of cybersecurity would then be reported to our board of directors. As of the date of this report, we have not had any material cybersecurity incidents.

companyName: INTERPARFUMS INC

ticker: IPAR


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Cyber security risks and cyber incidents could adversely affect the Company's business and disrupt operations."

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: We have a Third-Party Risk Management ("TPRM") Program that includes the comprehensive evaluation of the cybersecurity risks of prospective and existing third-party relationships. The TPRM Program utilizes a risk-based approach to perform third-party onboarding and ongoing due diligence reviews of existing third-party relationships. Third-party risks are identified and evaluated in coordination with period reviews, although threat intelligence monitoring and sound vendor relationships are leveraged to identify third-party risks as announced. TPRM is a function of our Risk Organization overseen by our Chief Risk Officer ("CRO").

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Because of the industry in which we operate, we are subject to extensive cybersecurity regulation, including but not limited to those regulations overseen by the FAA, TSA, and DOT. As a result, it is imperative our cybersecurity risk management is well-planned and sufficiently robust to maintain compliance with these regulations.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third party vendors' data and information systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report.

companyName: Sionna Therapeutics, Inc.

ticker: SION


text: We have relied on the third-party security assessment procedures and data outflow control procedures to manage risks from cybersecurity threats associated with our use of third-party service providers. For example, the servers of the system of XXTX are housed at third-party data centers, and its operations depend on the service providers' ability to protect such systems in their facilities as well as their own systems. The qualified third-party performs security assessment by timely assessing their cybersecurity policies, data encryption and privacy policies and relevant certificates, establishing procedures in granting such third parties access to our database and requiring them to conduct regular inspections. Since in cooperation with third-party service providers may involve data outbound, we desensitize sensitive information before transferring such data.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention any material risks. Under the oversight of the Audit Committee, the Company's Chief Executive Officer is primarily responsible for the assessment and management of cybersecurity risks and utilizes third-party consultants retained by the Company for advice.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract research organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, review of the vendor's written security program, review of security assessments and other reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure and procedures in an effort to prevent, detect, address and mitigate these risks. The Company's Chief Information Security Officer (CISO) oversees the Company's enterprise cybersecurity strategy while the Company's Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company's Board of Directors' oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure. The Company's CISO has more than 26 years of experience in the field of information technology and security, comprised of six years in the U.S. Defense Industry and 20 years in the civilian sector. The CISO has a bachelor's degree in computer studies and is an EC-Council Certified Chief Information Security Officer, as well as a member of ISACA (formerly known as the Information Systems and Audit and Control Association) and the governing bodies for the Evanta National CISO community and the Evanta Regional (Dallas, Texas) CISO community.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: The American Equity Chief Information Security Officer provides oversight and direction for the Program and communicates the information security risk posture and the prevention, detection, mitigation, and remediation of cybersecurity incidents to the American Equity executive team and American Equity's Board of Directors. The Board oversees the Program and management of risks from cybersecurity threats and reviews and monitors American Equity's business and technology strategy.

companyName: American National Group Inc.

ticker: ANG-PD


text: The Chief Operating Officer is National Association of Corporate Directors ("NACD") Directorship Certified and has earned the NACD certificate in cyber risk oversight.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Estrella stores all critical data in the cloud and does not maintain on-premise servers. Daily backups are conducted and monitored to protect financial and operational data from loss or breach. Periodic restore tests are also performed to verify the integrity of the data.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: Various individuals that are part of our Cybersecurity Function are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: CS Disco, Inc.

ticker: LAW


text: Our Audit Committee receives quarterly updates from the Chief Information Officer ("CIO") on significant risks, cyber incidents, key performance indicators measuring the effectiveness of our cybersecurity risk program, and other relevant matters, and regularly reviews the measures implemented by the Company to identify, treat, mitigate, and transfer cybersecurity risk. The Audit Committee regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk through our broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Audit Committee and the Board. In addition to the regular updates to the Audit Committee, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Our Chief Digital and Information Officer (CDIO), our CISO, and senior members of our information security group are responsible for identifying, assessing, and managing risks from cybersecurity threats. Our CISO, who manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security group and through internal escalation procedures, reports to the CDIO, who reports directly to our Chairman, President, and Chief Executive Officer.

companyName: LOWES COMPANIES INC

ticker: LOW


text: Our cybersecurity incident response process involves a multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders, including if appropriate the audit committee and the board, and keeping them informed and involved as appropriate. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, we have experienced incidents that did not have a material impact on our business or operations, and there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. See "Risk Factors" above for more information about the cybersecurity risks we face.

companyName: Genpact LTD

ticker: G


text: Our cyber risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties, as appropriate. Under the plan, a Cybersecurity Intake Team (CIT), which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Our information security program is overseen by our VP of Information Technology ("IT"). The VP of IT reports to the Chief Financial Officer and oversees the team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The VP of IT possesses over twenty-five years of experience in information technology and approximately ten years in cybersecurity risk management.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: We did not identify a material security breach during the year ended December 31, 2023, nor have we identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: The Bank's board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The board's Enterprise Risk and Operations Committee oversees the Bank's information security program through setting of policies and the Bank's risk management framework and has oversight of the cybersecurity risk management efforts which include risks from cybersecurity threats and has assigned specific controls for the mitigation, monitoring and reporting associated with those risks. The board also oversees management's approach to staffing, and processes and practices to gauge and address cybersecurity and information security risk. The board receives reports on management of cybersecurity risk and implementation of cybersecurity risk management as well presentations and reports on cybersecurity effectiveness assessments and monitoring updates, along with management's recommendations regarding Bank's information security policies.

companyName: Federal Home Loan Bank of Atlanta


text: Our Board of Directors has established management committees including the Innovation and Technology Steering Committee (ITSC), which focuses on overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cybersecurity program. These committees provide oversight and governance of the cybersecurity program and are chaired by the CIO and Chief Operational Risk Management Officer, respectively, and include the CISO and other key departmental managers from throughout the Company. The ITSC meets quarterly and the Operational Risk Management Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage cybersecurity risks. More frequent meetings occur from time to time in accordance with the incident response plan to facilitate timely informing and monitoring efforts. The CISO reports summaries of key issues, including significant system failures, interruptions or cybersecurity breaches, discussed at committee meetings and the actions taken to the Innovation and Technology Committee of our Board of Directors on a quarterly basis (or more frequently as may be required by the incident response plan). Additionally, the Chief Operational Risk Management Officer reports summaries of key cybersecurity risks to the Risk Committee of our Board of Directors on a quarterly basis.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: 1. Governance: Our board's oversight of cybersecurity risk management is supported by our Audit Committee of our board (the "Audit Committee"), which regularly interacts with our executive leadership, including our Chief Executive Officer, Chief Financial Officer and our General Counsel and other key officers.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: We comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF and have accordingly certified our adherence to the respective DPF principles to the U.S. Department of Commerce with regard to the processing of personal data received from the EU, UK and Switzerland respectively. This includes compliance with the information security requirements of the DPF that prescribe that organizations creating, maintaining, using or disseminating personal data must take reasonable and appropriate measures to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: THE NEW YORK TIMES COMPANY – P. 25 As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations. Notwithstanding our ongoing investments in our cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Our cybersecurity risk management program is designed to align with industry-standard cybersecurity frameworks and includes processes related to each of the following functions: identification, protection, detection, response, and recovery. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contract with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. Our cybersecurity team engages third-party security experts to assist with our processes for assessing, identifying, and managing risks from cybersecurity threat, including, for example, assessment of the maturity of our cybersecurity risk management program, penetration testing, employee awareness testing, phish testing, and incident monitoring and response, including conducting tabletop exercises.

companyName: Massimo Group

ticker: MAMO


text: Our cybersecurity risk management program includes: • assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and • a risk evaluation of our service providers, suppliers, and vendors of critical systems during contracting.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate strategy for information security is led by our Chief Technology Officer ("CTO"), who develops and directs our information security strategy and policy. He also oversees the engineering and operations related to cybersecurity and issues the proper response when a cyber threat is detected. Our CTO has 22 years of experience in technology and 16 years in compliance and cybersecurity management. Cybersecurity strategy and updates are reviewed by our senior management team on a periodic basis. The audit committee periodically receives a report on cybersecurity matters and related risk exposure from our CTO or senior management and discusses this exposure and our risk management strategies and related controls with management and the internal and external auditors. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.

companyName: PAMT CORP

ticker: PAMT


text: Creating and maintaining a secure information infrastructure is of paramount importance to Quantum-Si, and we have invested, and will continue to invest significant resources to ensure we maintain the most secure environment reasonably possible to protect our assets, customers and employees. Our Board of Directors, through our Audit Committee, is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, ("NIST") and other applicable industry standards. We address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we maintain by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Quantum-Si Inc

ticker: QSI


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats for our Company, if any, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: CORNER GROWTH ACQUISITION CORP. 2


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data).

companyName: Tracon Pharmaceuticals, Inc.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our management team is informed of and monitors the prevention, detection, and mitigation of cybersecurity threats and incidents.

companyName: Checkpoint Therapeutics, Inc.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information and data that is proprietary, strategic or competitive in nature (together, "Information Systems and Data").

companyName: Akili, Inc.


text: As stated above, the CIO is a member of the ISGC, chairs the ITSC, and reports to the CSIO. The CIO has over 40 years of business experience in information technology and cybersecurity and is a Certified Bank Cybersecurity Manager. The virtual CISO is outsourced to a third-party vendor that specializes in partnering with organizations to enhance cybersecurity management and reports to the CRO.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Management is responsible for the day-to-day risk management process, including the identification of risks and implementation of policies and procedures designed to manage, mitigate or monitor cyber risks. In support of these responsibilities, management has formed a Compliance Committee and designated a Chief Compliance Officer to implement, manage and oversee a corporate compliance program.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Asbury's information and data security training programs are housed in a Learning Management System (LMS). We migrate our acquired companies into Asbury's current LMS.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: General risk assessment and management oversight resides with the Company's Board of Directors. The Company's Audit Committee has oversight of financial risks and is in charge of reviewing the Company's information security disclosures and incident reporting related to cybersecurity. The Company's Board of Directors reviews the Company's information security procedures and evaluates management's assessment of materiality for cyber incidents. The Board of Directors is formally updated on cybersecurity risks no less than annually. Management is responsible for assessing and managing material risks from cybersecurity threats. This responsibility primarily resides with the VP of Information Technology and his qualified team, including dedicated cyber security personnel. The qualifications of the Information Technology team include a combination of formal education (e.g. Master's degrees in Cybersecurity and Information Assurance); CISSP and ISSMP certifications and, over 100 years of combined Information Technology experience. Management's process for monitoring prevention, detection, mitigation, and remediation of cybersecurity incidents is summarized above in the Risk management and strategy section.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the company and form detection, mitigation and remediation strategies.

companyName: TrueCar, Inc.


text: The Audit Committee (the "Committee") is primarily responsible for oversight of the Program. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. Yingping Zhang serves as our Vice President of Information Technology, and she also helps oversee the implementation and effectiveness of the Program as a member of the ISWG. Ms. Zhang graduated from the University of Pittsburgh with a Master of Science in Electrical Engineering and has over thirty years of experience as an information technology professional. Prior to Avalo, Ms. Zhang worked as an Executive Consultant for Insightful Group, the Vice President of Information Technology at Horizon, and the Vice President of Informational Technology and Information Services at Viela Bio, among other positions within biopharma companies. Ms. Zhang reports to Lisa Hegg, Senior Vice President of Program Management and Corporate Infrastructure. Ms. Hegg provides information technology and cybersecurity reports as necessary at meetings of management's Disclosure Committee, which is communicated quarterly to the Audit Committee, with greater frequency as necessary. Ms. Zhang regularly informs Ms. Hegg, our Chief Executive Officer (CEO) and other members of the leadership team, about the Program, best practices, current cybersecurity threats, the risk landscape, and mitigation strategies. These reports include the following on an as-needed basis: updates on the Program; assessment of the Program; emerging risks or concerns; policies, procedures, and training; and risk mitigation strategies.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, engaging in incident detection and response, encrypting certain of our data, maintaining network security and access controls, maintaining physical security, utilizing asset management, tracking and disposal, engaging in systems monitoring, training employees, engaging in penetration testing and maintaining cybersecurity insurance.

companyName: Kronos Bio, Inc.


text: The Company relies on the Adviser and Lord Abbett to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and enterprise risk management processes, including those applicable to the Company.

companyName: Lord Abbett Private Credit Fund


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Security Operations ("SecOps") team monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, followed by assessing and prioritizing risks. We employ various tools and techniques like threat modeling, vulnerability scanners, and penetration testing. Based on the assessment, security measures are implemented. We have implemented regular security awareness training programs for employees to educate them on cybersecurity best practices and to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: We utilize several third-party organizations to host our products for customers. We monitor the secure provision of these services, our security team performs thorough vetting prior to, and periodically throughout the relationship with third-party vendors. To help provide reasonable security assurance of the security practices and mechanisms at these third parties, we request and review copies of the third-party assurance reports provided by these organizations on an ongoing basis to confirm their controls are operating effectively. Legal contracts with these third parties also include security provisions to help ensure the implementation and operation of effective security controls at the third-party organizations. Furthermore, we host all customer-facing web applications and supporting infrastructure on AWS. We rely on AWS' ability to design and operate the critical mechanisms and controls to protect physical access to data and availability of our services. AWS has represented to us that their data centers utilize state-of-the-art electronic surveillance and multi-factor access control systems, among other security measures, including permanent trained security guards and limited access.

companyName: INSTRUCTURE HOLDINGS, INC.


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident or other threats that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: The audit committee receives periodic reports from our IT Lead concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Risk Management Strategy We have a comprehensive cybersecurity risk management strategy to assess, identify, and manage material risks from cybersecurity threats. The core of this strategy is our digital risk and security program, which is integrated into our overall enterprise risk framework and is based on industry standards and established frameworks such as National Institute of Standards and Technology (NIST) and other guidelines. Our program is designed to help protect our systems, data, and operations from potential cyber threats, ensure the continuity of business operations, ensure we comply with applicable privacy and other laws and regulations, and meet our commitments to our members, customers, suppliers, employees, and other stakeholders.

companyName: Premier, Inc.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. From time-to-time, we and our third-party service providers, suppliers and trade customers experience attempts to infiltrate and interrupt information systems. To date, we have not experienced any interruptions of these information systems as a result of infiltration attempts. For further discussion of the risks related to cybersecurity, see Risks Relating to Our Business - Information Technology and Data Privacy Risks in Item 1A.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is integral to assessing and managing our material risks from cybersecurity threats. While all members of management are involved in the review of these risks, our CIO oversees and is responsible for our cybersecurity program. Our CIO is a seasoned technology leader and change agent who has served as the top technology executive for multi-billion-dollar global organizations spanning diverse industries. With over 25 years of experience, our CIO has led business and information technology transformations, implemented global digital strategies, and optimized and integrated governance, risk, and compliance frameworks, processes and technologies in complex regulatory and industry environments. We believe our CIO's knowledge, skills and experience provide significant value to our Company.

companyName: MKS INC

ticker: MKSI


text: The Audit Committee receives regular reports from various individuals that are part of the Cybersecurity Function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee and full board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: CS Disco, Inc.

ticker: LAW


text: Our management team, including our vice president of technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises both our internal cybersecurity and IT personnel, as well as our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our cybersecurity program is led by our Chief Information Officer ("CIO") who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology and program management experience and many years of experience with our organization. Our CIO reports to our president and CEO.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: GE Vernova has processes for assessing, identifying, and managing cybersecurity risks that are built into our risk management program and IT functions. These processes are designed to help protect our information assets from internal and external cyber threats, protect employee information from unauthorized access or attack, and secure our networks, systems, and products. We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and networks using a risk-based approach. The framework is informed in part by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. This approach does not imply that GE Vernova meets all technical standards, specifications, or requirements under the NIST Cybersecurity Framework or ISO 27001.

companyName: GE Vernova Inc.

ticker: GEV


text: The Company employs comprehensive methodologies for risk assessment and diligently identifies and evaluates potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: The Audit Committee periodically reviews the Company's cybersecurity policy and programs established by management to mitigate cybersecurity and data risks. The periodic reviews take place on a quarterly basis and include reports from the Company's cybersecurity team led by the Company's Chief Information Security Officer ("CISO") who has over 10 years of data security experience. The quarterly report provides an overview of cybersecurity threats, key measures in place to mitigate cybersecurity threats and vulnerabilities, provides a status of ongoing security projects to strengthen the Company's cybersecurity posture, as well as plans and resource needs for addressing possible future cybersecurity threats and vulnerabilities. The Company's cybersecurity policy is centered on mitigating risks related to cybersecurity, privacy, physical security, and information security risk management.

companyName: Abacus Global Management, Inc.

ticker: ABX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity software, and darkweb monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies.

companyName: Kura Oncology, Inc.

ticker: KURA


text: The Company has not adopted any insider trading policies and procedures governing the purchase, sale, and/or other dispositions of the Company securities yet, as we are still in the restructuring process. We however plan to adopt this soon once the restructuring process is done.

companyName: Aphoenity International Holdings Inc.


text: Our management team, including the Chief Executive Officer ("CEO"), CIO, Chief Marketing Officer, and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The CIO, in collaboration with the Audit Committee, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. to Board of Directors cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: Duncan Fulton. Mr. Fulton was appointed Chief Corporate Officer of RBI, in June 2018, overseeing global communications, North American franchising, government relations and ESG initiatives. Mr. Fulton also serves as Chairman of the Board of Directors for the Tim Hortons Foundation. Prior to joining RBI, Mr. Fulton held several positions with Canadian Tire Corporation (CTC) from November 2009 to March 2018, including Senior Vice President of Corporate Affairs, Chief Marketing Officer for FGL Sports and Mark's Work Warehouse, and President of FGL Sports. Previously, Mr. Fulton was Senior Partner and General Manager of Fleishman-Hilliard from April 2002 to November 2009. Prior to his agency experience, Mr. Fulton served as a communication advisor and spokesman for several political leaders, including former Canadian Prime Minister Jean Chr tien, Ontario Premier Dalton McGuinty and New Brunswick Premier Frank McKenna.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Cyber criminals do, however, target us, TPG and TPG's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or TPG's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors— Operational risks, including the risks of cyberattacks, may disrupt our businesses, result in losses or limit our growth".

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, partners and customers. We understand the increasing reliance of our customers, suppliers, and partners on our digital platforms. Our goal is to strengthen our digital infrastructure, ensuring the highest levels of customer service while effectively managing risks and adhering to global compliance standards. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and we continually monitor our overall security to assess performance and identify areas for improvement.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: We adhere to industry-leading frameworks to safeguard our systems and data. The primary framework we follow is the HITRUST Common Security Framework (CSF). The HITRUST CSF provides a comprehensive, scalable, and technology-neutral approach to regulatory compliance and risk management. It encompasses information security risk management controls, including risk assessment, mitigation, and evaluation. Our processes for assessing, identifying, and managing material cybersecurity risks align with HITRUST CSF guidelines.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Our CISO implements a program and supporting processes to proactively assess systems for vulnerabilities, while taking a risk-based approach to prioritize remediation steps. Should a cybersecurity incident occur, the CISO would reference an incident response plan and supporting playbooks to support the incident response process. We regularly test our incident response process by leveraging a combination of internal resources and trusted third-party consultants to test our response readiness and the completeness of our incident response plan through the use of tabletop exercises.

companyName: Enpro Inc.

ticker: NPO


text: We perform regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists, and engage independent auditors to periodically review our cybersecurity program, including our process, systems, and control effectiveness, and provide recommendations to continuously strengthen our program. Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness.

companyName: SIERRA BANCORP

ticker: BSRR


text: Board Reporting. At least annually, the CIO reports to the Board of Directors, directly or through the ERM Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Our Response Team is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Response Team includes our President and Chief Operating Officer (and current President and Chief Executive Officer effective January 1, 2025), our Executive Vice President and Chief Financial Officer, our Director of IT, our Business Systems Manager, our Corporate Controller and our Director of Internal Audit. The Response Team members' relevant experience includes overseeing IT departments, reviewing existing security measures, and implementing solutions to mitigate security risks that may pose threats to a business.

companyName: American Assets Trust, Inc.

ticker: AAT


text: In the last fiscal two years, we have not experienced any material cybersecurity breach incidents. For additional information about our cybersecurity risks, please see "Item 1A. Risk Factors – We depend on computer and telecommunications systems, and failures in our systems or cybersecurity attacks could significantly disrupt our business operations."

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of such risks.

companyName: PRUCO LIFE INSURANCE CO


text: The Board of Directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value. The Director of IT provides a report to the Board of Directors on an annual basis, or more frequently as needed, with respect to information security activity, security assessments, controls and investments.

companyName: ASTRONICS CORP

ticker: ATRO


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors—Business and Operational Risks" of this Form 10-K, cybersecurity threats remain a risk to our business operations.

companyName: Parker-Hannifin Corp

ticker: PH


text: Our CIO, together with our Senior Director of Information Security and other members of the IT leadership team, are responsible for assessing and managing cybersecurity risks. Our CIO has over ten years of experience managing information technology and cybersecurity. Our Senior Director of Information Security has over 25 years of experience managing information technology and cybersecurity matters and is certified as a Certified Information Systems Security Professional (CISSP). We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.

companyName: Ultragenyx Pharmaceutical Inc.

ticker: RARE


text: We provide cybersecurity training to associates, which includes monthly phishing exercises, to help them protect sensitive information and follow best practices. We offer role-based training for regulatory compliance and work with external partners to develop and deliver education and training to mitigate cybersecurity risks. We continually evaluate trends within the industry, apply necessary controls and empower our leadership to make informed, risk-based decisions.

companyName: PVH CORP. /DE/

ticker: PVH


text: Our CISO attends quarterly meetings of the Company's Disclosure Committee and provides input on the Company's disclosures in its Quarterly Reports on Form 10-Q and Annual Reports on Form 10-K, including the relevant risk factors set forth therein. The Company's CISO, along with the Information Security Team, also leads our Security Incident Response Team, which is responsible for investigating suspected cybersecurity threats and incidents. In the event of a possibly material cybersecurity incident, the Information Security Team also includes the following executive team members: Corporate General Counsel, Chief Legal Officer, Chief Accounting Officer, Chief Financial Officer and, to the extent practicable or relevant, other senior executives.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Notwithstanding the extensive approach TEGNA takes to cybersecurity, we face a number of cybersecurity risks in connection with our business. Although to date such risks have no t materially affected us, including our business strategy, results of operations or financial condition, we have from time-to-time experienced threats to our information systems and data. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors".

companyName: TEGNA INC

ticker: TGNA


text: However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Ault Disruptive Technologies Corp


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our CFO is responsible for the oversight of risks from cybersecurity threats, having prior experience managing business risks including those related to cybersecurity. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. Although management and the Board will be made aware of cybersecurity incidents that could materially impact the Company, formal monitoring of all cybersecurity incidents is planned for future implementation.

companyName: FORUM MARKETS Inc

ticker: FRMM


text: The Board has delegated to certain committee's oversight responsibility for risks that are directly related to each such committee's area of focus. The Audit Committee oversees our major financial risk exposures, including cybersecurity. The Audit Committee receives periodic reports from management regarding cybersecurity and management's assessment of current and future cybersecurity risks. The ERM process, which includes cybersecurity, is performed annually and updates are discussed quarterly, both internally and with the Audit Committee. The Audit Committee communicates the results of the annual process and quarterly updates to the full Board. The Board and committees thereof, including the Audit Committee, regularly receive reports from the Company's management and the Company's outside counsel, as appropriate, regarding the risks faced by, or anticipated to be faced by, the Company, including risks from cybersecurity threats. When such reports relating to cybersecurity are delivered to the Audit Committee, the Audit Committee's review of such reports, and discussions with management, informs the Audit Committee in detail of the material risks facing the Company related to cybersecurity.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.

companyName: Certara, Inc.

ticker: CERT


text: Our Director of Cyber Security & Infrastructure ("DCSI") oversees our information security function, which in conjunction with our security and engineering operations, Security Operations Center, a third-party managed security provider, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing certain reports of cybersecurity threats and threat actors; conducing scans of our environment; evaluating our and our industry's risk profile and certain threats reported to us; coordinating with law enforcement concerning certain threats; conducting internal and external audits and threat assessments; conducting vulnerability assessments; using external intelligence feeds; and working with a third-party to test our incident response processes.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Security and privacy reviews designed to identify risks from new features, software, suppliers and vendors; • A vulnerability management program designed to identify software vulnerabilities; • A variety of tools designed to monitor our networks, systems, and data for suspicious activity; • An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors; • A threat intelligence program designed to model and research our adversaries; • Products and services to structure, test, and assess the rigor of our software security practices; • A variety of privacy, cybersecurity, and incident response trainings and simulations, including regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; • For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and • Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.

companyName: SYNOPSYS INC

ticker: SNPS


text: Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • a compliance team principally responsible for managing our risk assessments, which are designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for partners and vendors.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Customer service software centralizing and automating customer support for seamless interactions across email, live chat, social media, and self-service portals. Provides ticketing, reporting, analytics, and integrations.

companyName: RYTHM, Inc.

ticker: RYM


text: While the Company has experienced, and may in the future experience, cybersecurity incidents, prior incidents have not materially affected the Company's business, results of operations or financial condition. Although the Company has invested in the protection of its data and information technology and monitors its systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to Company information technology systems that could have a material adverse effect on the Company's business. For additional information, refer to "A significant cybersecurity incident or data privacy breach may adversely affect the Company's reputation, revenue and earnings," in Item 1A. Risk Factors.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Role of the Board The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk. The Board has delegated responsibility for oversight of the Company's cybersecurity framework and risk management to the Audit Committee.

companyName: Garrett Motion Inc.

ticker: GTX


text: We have implemented a cybersecurity program for assessing, identifying, and managing cybersecurity risks aligned with the National Institute of Standard and Technology Cybersecurity Framework (NIST CSF) and where appropriate we have integrated these processes into our enterprise risk management framework. We have implemented administrative, technical, and physical safeguards designed to protect our information systems and protect the confidentiality, integrity, and availability of our data. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: Our cybersecurity efforts also include mandatory information security awareness training for all employees, clearly defined expectations for acceptable use policies, and certification of adherence to a code of conduct. The IT Governance, Risk, and Compliance team conducts periodic audits to evaluate policy and regulatory compliance, recording findings for subsequent review and remediation initiatives. We also leverage internal and external security subject matter experts to conduct comprehensive risk assessments, including architecture reviews, vulnerability scans, penetration tests, application security evaluations, and technical compliance reviews.

companyName: CLARIVATE PLC

ticker: CLVT


text: The CISO manages Exelon's enterprise-wide cybersecurity programs and reports to Exelon's Chief Information Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Exelon since 2018 and was named to the current role in 2022. The CISO has 26 years of information technology and cybersecurity experience in the critical infrastructure sector, of which 24 years have been in the utility industry. The CISO leads CISS, which manages centralized information technology and operational technology security programs for the Registrants. The programs are aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and integrate cyber asset identification; threat assessment;

companyName: EXELON CORP

ticker: EXC