text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform PepsiCo during contracting and vendor selection processes. Additionally, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked and periodic monitoring is conducted for third parties in order to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a successful material cyberattack, the Company has established well-defined response procedures to address cyber events that do occur. The program provides for the coordination of various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to assess for potential disclosure, comply with potentially applicable legal obligations and mitigate brand and reputational damage. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures.

companyName: PEPSICO INC

ticker: PEP


text: Under the oversight of the audit committee of the Company's board of directors, the Company's Chief Executive Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.

companyName: MDWerks, Inc.

ticker: MDWK

secItem: Item 1C


text: Cybersecurity Risk As of December 31, 2023, the Company is not aware of any material cybersecurity incidents that impacted the Company. However, we routinely face risks of potential incidents, whether through cyberattacks or cyber intrusions over the internet, ransomware, and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion, or other scams. Notwithstanding our risk management efforts related to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material or other adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our information technology and cybersecurity risks.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by the Chief Financial Officer to the Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually.

companyName: CODEXIS, INC.

ticker: CDXS


text: In the fourth quarter of fiscal 2025, we became aware of unauthorized activity on certain of our information technology systems. We promptly activated our incident response plan and implemented containment measures, including proactively taking certain systems offline (the "Cybersecurity Incident"). As a result, our ability to fulfill and distribute customer orders was temporarily impacted until the unauthorized activity could be contained, and we could safely restore the core systems that our customers and suppliers use, enabling business operations to normalize. As a result of the Cybersecurity Incident, we experienced reduced sales volume and increased operational costs in the fourth quarter of fiscal 2025, which negatively impacted our results of operations.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program and discusses with management the Company's cybersecurity and other information technology risks, controls, and procedures.

companyName: ITT INC.

ticker: ITT


text: We maintain a cybersecurity risk management program that is an important and integrated part of our enterprise risk management function and is designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology cybersecurity framework, or the NIST Framework. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: AZEK Co Inc.


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cybersecurity Framework for IT. We have an Information Technology Steering Committee that oversees the IT function, material projects, budgeting, and cybersecurity. In addition, we have an Incident Response Team, as highlighted in our cybersecurity policy to respond to any information security risks or incidents. These committees report directly to the Audit Committee of the Board of Directors, which is responsible for overall oversight of the Company's cybersecurity program.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Risk Assessment: No less frequently than annually, our Manager completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Manager. To supplement our Manager's internal assessment, our Manager also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Project, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: The SVP, E&O holds key skills, experience, and competencies related to the management of cybersecurity matters. In particular, our current SVP, E&O has over 30 years of experience leading IT and OT physical security and cybersecurity.

companyName: Summit Midstream Partners, LP


text: During fiscal 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not successfully eliminate all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see the section titled "Risk Factors—Risks Related to Our Business Operations and Industry—Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: CG Oncology, Inc.

ticker: CGON


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company in the future, including our business strategy, results of operations, or financial condition, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: TWILIO INC

ticker: TWLO


text: Employee Awareness and Training: Our employees play a pivotal role in maintaining a strong cybersecurity posture. Our Information Security Policy Framework outlines the requirements for employee conduct concerning company information and company-managed devices, encompassing relevant privacy, data security, and data retention policies. We believe our Information Security Policy Framework aligns with industry best practices and applicable legal and regulatory requirements. Complementing our Information Security Policy Framework, we conduct regular cybersecurity training campaigns that emphasize the importance of cybersecurity awareness. These campaigns address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness, and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness and testing exercises.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: 2.Due Diligence: Prior to engaging with third-party service providers, we conduct due diligence assessments to evaluate their cybersecurity controls, practices, and compliance with industry standards and regulations. This due diligence process includes assessing the vendor's security policies, procedures, incident response capabilities, and contractual obligations related to cybersecurity.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could potentially impact Organogenesis. We are developing and implementing processes for overseeing and managing these risks and are committed to maintaining robust governance and oversight of these risks. Those processes include assessing the third parties' cybersecurity practices and where applicable, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them including conducting ongoing monitoring of their compliance with those requirements.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. In addition, we provide end user education on various cybersecurity related topics through a partnership with our human resources team.

companyName: VINEBROOK HOMES TRUST, INC.


text: 1. Cybersecurity Risk Management Program – The Company's cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company's cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).

companyName: QUINSTREET, INC

ticker: QNST


text: As a global aerospace and defense company serving commercial and government customers in the aerospace industry and domestic and international military and government customers as a defense contractor, we are the target of advanced and persistent cyber-attacks from a variety of threat actors. Our products and services are highly sophisticated and specialized, involve complex advanced technologies including information technology systems, and process, store, or transmit highly sensitive unclassified and classified information. Moreover, our products and services are often integrated with third-party products and services. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure.

companyName: RTX Corp

ticker: RTX


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit Committee (the "Committee"). The Committee has primary responsibility for overseeing our risk management practices, programs, policies, and procedures related to data privacy, data protection, and cybersecurity. The Committee reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect our business. The Committee regularly discusses with management, legal counsel, and the internal audit department our major risk exposures. This includes potential financial impact on us and the steps taken to monitor and control those risks. Reviews with management are done annually, which includes a summary of legal and regulatory compliance matters and risk management activities, and a review of our cybersecurity program. Additionally, the Committee oversees the process by which our Board of Directors is informed regarding the risks facing us and coordinates with our legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: The Company's Board of Directors (the "Board") has oversight of the management of the most significant risks facing the Company, including cybersecurity. The Board receives information technology and cybersecurity updates from senior management, including the Chief Information Officer, Chief Information Security Officer ("CISO") and Chief Technology Officer, several times per year. These updates cover the cybersecurity risks facing the Company's enterprise information technology environment, as well as the Company's digital products and services. Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee. The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Information Officer and CISO, to review the Company's cybersecurity program, including the highest risk areas and key mitigation strategies.

companyName: Johnson Controls International plc

ticker: JCI


text: Additionally, as part of our continuous overall cybersecurity posture assessment, we conduct incident simulations based on recent public cybersecurity incidents, incorporating the tactics, techniques and procedures threat actors have used when targeting organizations. We leverage results from these simulations to take corrective action or otherwise augment our abilities to defend and protect our information systems.

companyName: Compass, Inc.

ticker: COMP


text: We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Office ("CCO"), which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: In addition, we engage several third-party consultants in connection with our risk assessment and risk management, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments and risk management are required to provide reports designed to allow us to monitor and assess such third parties' security controls.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: In connection with the Company's review and approval for potential new vendors, the Company assesses the data types or Personally Identifiable Information that the vendor may maintain, store or access and reviews the adequacy of their cybersecurity procedures and legal protections. Legal counsel and the VP, Chief Privacy Officer review the cyber and contractual protections and consider the overall risk profile considering the type of agreement, data involved, vendor, and jurisdiction, among other factors. Vendors deemed to have insufficient controls balancing the relevant criteria will not be approved.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Periodic independent, third-party reviews of our program and its maturity based on the National Institute of Standards and Technology (NIST) cybersecurity framework;

companyName: TopBuild Corp

ticker: BLD


text: For additional information related to cybersecurity risks that could have a material and adverse effect on our business, financial condition or results of operations, see "Our operations could be adversely affected by interruptions or breaches in the security of our computer and information systems" in Item 1A of this Report.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: We have implemented a multi-faceted cybersecurity program in accordance with globally recognized standards to protect the confidentiality, integrity, and availability of our information assets. The primary aims of this program are to devise, initiate, and maintain a cybersecurity approach that safeguards our systems, services, and data from unauthorized access, outages, exposure, modification, damage, and loss.

companyName: Alector, Inc.

ticker: ALEC


text: Engagement of Third Parties The Company uses an IT Managed Service Provider in conjunction with a Cybersecurity Advisory firm to perform various functions, guiding the Company's cybersecurity posture, and providing ongoing support to the Company's cybersecurity program. The Company has Incident Response retainer services that can be leveraged, when needed. The Company uses a cybersecurity advisory firm to conduct annual risk assessments and penetration tests.

companyName: Drilling Tools International Corp

ticker: DTI


text: Cybersecurity is a significant part of our risk management processes and an area of focus of our Board of Directors and management. Our CTO is primarily responsible for assessing and managing material risks from cybersecurity threats. Our CTO has six years of cybersecurity experience.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: The Company's information technology systems are in some cases integrated, such that damage, disruption or shutdown to one system could result in a more widespread impact on the Company's systems as a whole. If the Company's information technology systems suffer severe damage, disruption or shutdown, and its business continuity plans do not effectively resolve the issues in a timely manner, the Company's business could be negatively affected. In addition, cyber-attacks could lead to potential unauthorized access and disclosure of confidential information, data loss and corruption (see "Item 1A. Risk Factors" under the heading "The Company relies on information technology, and if it is unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, its operations could be disrupted and its business could be negatively affected" of this Annual Report on Form 10-K. A cybersecurity incident could materially harm the Company's reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer. They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports. They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors.

companyName: Sprout Social, Inc.

ticker: SPT


text: Board's Role in Oversight of Risks from Cybersecurity Threats Our Board of Directors has appointed the Audit Committee to assist in fulfilling its responsibilities with respect to the oversight of cybersecurity, data privacy and information technology. Several of our Directors, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity and meet regularly with members of our management team to advise on cybersecurity matters and technology initiatives.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: Beginning in May 2021, the Department of Homeland Security's (DHS) and the Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural. These directives cumulatively require owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies; implement a significant number of specified cyber security controls and processes; and clarifying Operational Technology (OT) scope and providing a risk- and outcome-based framework. We made significant additional and accelerated investments in cybersecurity in response to the TSA directives. In November 2024, the TSA proposed regulations with the aim of making the security directives permanent by incorporating them into the US Code of Federal Regulations.

companyName: Northwest Natural Holding Co

ticker: NWN


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Trustees, our audit committee regularly interacts with, and receives reports from, our management, the Adviser, Apollo, and other service providers. The audit committee of our Board of Trustees receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: Apollo Debt Solutions BDC


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks.

companyName: Carriage House Event Center, Inc.


text: of Cybersecurity Risks on Business date, the Company has no t experienced a cybersecurity incident that has materially affected our operations, reputation, or financial performance. However, like other public companies, we remain exposed to cyber threats that may arise from internal or external sources. We continue to invest in technologies and partnerships to mitigate such risks and safeguard our digital assets.

companyName: Eva Live Inc

ticker: GOAI


text: At Graphite Bio, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Risk Management Strategy The Company's cybersecurity risk management function is led by the Vice President of Information Technology, who evaluates processes and activities within the Company's information technology infrastructure and automated systems. In 2023, the Company completed a detailed assessment to identify all technology and cyber tools currently in place and assessed its information technology personnel's cybersecurity capabilities and skill sets. In 2023, the Company focused on formalizing cybersecurity procedures and defining standards for risk identification and communication activities. The Company utilizes the National Institute of Standards and Technology guidance in all cybersecurity policies and procedures. Annual training for employees is required as well as ad hoc trainings for specific topics or events as deemed appropriate throughout the year. The Company also has cyber insurance to assist the Company both financially and operationally if a cyber event were to occur. Below is the basic framework used in the Company's risk management strategy: • Identify - set of procedures to identify assets to be protected, including computation, data, and integrity; • Protect - set of procedures to effectively engage and monitor adequate safeguards of critical infrastructure services; • Detect - set of activities, tools, and procedures to timely identify anomalies through continuous monitoring; • Respond - set of activities to effectively respond to and contain detected and confirmed cybersecurity events, and • Recover - set of activities and procedures to ensure any assets impaired because of a cybersecurity event are restored to use within the stated recovery point/time objectives.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: a Cybersecurity & Technology Risk Committee, comprised of technology and business leaders, that provides risk advisory and general guidance regarding new and modified information security controls;

companyName: Walker & Dunlop, Inc.

ticker: WD


text: One of the key responsibilities of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.

companyName: Empery Digital Inc.

ticker: EMPD


text: Our cybersecurity program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance" below, our board of directors' oversight of cybersecurity risk is supported by our audit committee, which regularly interacts with our ERM function, our Chief Digital Officer ("CDO"), our Chief Information Security Officer ("CISO"), other members of management, and relevant committees and working groups, including management's Enterprise Risk Committee ("ERC"), Cyber Incident Task Force ("CITF"), and Security Incident Response Team ("SIRT"), in its oversight of cybersecurity-related risk. • Risk Assessment. We devote significant resources and designate high-level personnel, including our ERC, which includes our Chief Legal Officer ("CLO"), our CDO, our CISO, our Vice President of Internal Audit, and our Vice President of Ethics, Compliance and Risk Management, to manage the cybersecurity risk assessment and mitigation process. We conduct security assessments both internally and with the assistance of third parties to identify cybersecurity threats periodically and to identify any potentially material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These security assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential impact of such risks, and the sufficiency and effectiveness of existing policies, procedures, systems, and controls to manage such risks. Risk themes identified during our risk assessments guide annual cybersecurity planning activities and investments to improve security coverage, technology capabilities and processes. • Technical Safeguards. We deploy, maintain, and regularly monitor the effectiveness of technical safeguards that are designed to protect our information systems from cybersecurity threats. We align our security program to recognized frameworks and industry standards. We make investments in core security capabilities, including awareness and training, identity and access, incident response, product security, cloud security, enterprise security, risk management, and supply chain risk, in order to enable us to better identify, protect, detect, respond to, and recover from evolving security threats. Our technical safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through internal and external security assessments and cybersecurity threat intelligence. We regularly assess our safeguards through internal testing by our assurance teams. We also leverage external third-party testing (e.g., penetration testing, attack surface mapping, and security maturity assessments) and seek third-party certifications (e.g., SOC2, ISO, and PCI DSS). Following our risk assessments, we evaluate whether and/or how to re-design and/or enhance our safeguards to reasonably address any identified risks or gaps. • Incident Response and Recovery Planning. We have established comprehensive incident response and recovery plans that address the full lifecycle of our response to a cybersecurity incident. These plans are periodically tested and evaluated.

companyName: TWILIO INC

ticker: TWLO


text: We have implemented an incident response plan and playbook, encompassing procedures designed to respond to and recover from internal cybersecurity incidents. In collaboration with third-party security consultants, we conduct ongoing reviews and tabletop exercises of these procedures, which provide detailed descriptions of the roles and responsibilities of key stakeholders, as well as the protocols for communication and coordination during an incident. The procedures also outline guidelines for escalating incident information to our Cybersecurity Steering Committee, senior management, our Audit Committee (which, as discussed below, has been delegated the responsibility for our Board cybersecurity risk oversight function), our full Board, and for providing timely public disclosure when necessary.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: To meet our business objectives, we rely on both internal information technology (IT) systems and networks, and those of third parties and their vendors, to process and store sensitive data, including confidential research, business plans, financial information, intellectual property, and personal data of ours and our customers that may be subject to legal protection, and promote the continuity of our Company's supply chain. In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information.

companyName: KLDiscovery Inc.


text: There can be no guarantee that our policies and procedures will ultimately prove to be effective in every instance, especially considering evolving risk. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that these risks have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: VACCINEX, INC.

ticker: VCNX


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment; • a security team, led by our Senior Vice President that oversees IT (our SVP IT), principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Daseke, Inc.


text: As part of its cybersecurity program, CSX partners with a third-party to provide a managed service that is designed to enable continuous monitoring at its Security Operation Center ("SOC"). The SOC has established processes to identify, address, and remediate cybersecurity threats or vulnerabilities. This includes the engagement, where necessary, of third-party experts, advisors, and other cybersecurity professionals that have been retained by the Company to assist in responding to cybersecurity incidents or threats. Company processes also include various procedures for notifying members of the company's cybersecurity department, Chief Information Security Officer ("CISO"), legal department, accounting department, and others as applicable.

companyName: CSX CORP

ticker: CSX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and forensic investigators.

companyName: Fintech Scion Ltd


text: In addition, we undergo an annual IT risk assessment reviewed by a third-party IT vendor, with significant or actionable findings reported to the Technology Business Review Committee. The annual IT risk assessment identifies our risk status on various IT security metrics and prioritizes remediation, external vulnerability scan results, patching reports, dark web status, and personnel IT security training reports. This annual third-party review helps further monitor and inform our Technology Business Review Committee's work and our cybersecurity risk management and strategy.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub committee of the firmwide Enterprise Risk Committee ("ERC").

companyName: iShares Silver Trust

ticker: SLV


text: Information security awareness training is provided to all employees and bank business units no less often than annually and focuses on: new hire orientation, the Company's overall information security program, roles and responsibilities of employees during an incident, how to report suspicious activity, and captures the Bank's cybersecurity blog for consistent and relevant information.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors and Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.

companyName: Laser Photonics Corp

ticker: LASE


text: Role of the Board of Directors and the Audit Committee As part of the Board's role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: The Company's Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of the Company. The Board oversees management's implementation of the Company's cybersecurity risk management program, receiving at least annual updates from management (including our Chief Information Officer) on cybersecurity risks, including briefings on the Company's cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.

companyName: RCM TECHNOLOGIES, INC.

ticker: RCMT


text: Processes designed to monitor cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access. These services are designed to monitor both internal and external threats.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: The Senior Director of IT and Cybersecurity has served in various roles in information technology and information security for more than two decades with a track record of managing systems compliant with relevant security standards. The Senior Director of IT and Cybersecurity has industry experience and education aligned with the Company's work and the data we maintain. The Senior Director of IT and Cybersecurity's expertise is complemented by that of the Company's CEO and Interim CFO, each with degrees in their respective fields and extensive leadership experience including experience managing risks at similar companies.

companyName: Axe Compute Inc.

ticker: AGPU


text: Our board of directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the audit committee of the board of directors through the audit committee charter. Members of the audit committee receive updates on a regular basis from management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, how management is addressing or mitigating those risks, cybersecurity and data privacy incidents (if any), and the status of key information security initiatives.

companyName: Karuna Therapeutics, Inc.


text: We have established processes and systems designed to assess, identify, manage, and mitigate cybersecurity risk and threats, including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercises, and recovery and resilience tests. We employ a variety of preventative and detective tools designed to monitor and block suspicious activity and to identify cybersecurity threats. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity professionals and third-party specialists. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancement. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third-party service providers. We also monitor our email gateways for malicious phishing campaigns and monitor remote connections for cybersecurity threats. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain members of the Company update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: HPS Corporate Lending Fund


text: Previous cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats could harm our business and could have a material adverse effect on our business, prospects, liquidity, financial condition and results of operations. See "Information system failures, cyber incidents or breaches in security could adversely affect us" under Item 1A. Risk Factors for a discussion of cybersecurity risks.

companyName: Emeren Group Ltd


text: Company adheres to cybersecurity practices shaped by relevant laws and industry benchmarks. We proactively manage cyber risks through a multidisciplinary framework designed to safeguard the integrity, confidentiality, and availability of our data and systems. This framework includes several key initiatives: Enterprise Risk Management—We identify primary cybersecurity threats to our operations. Vulnerability Management—We scrutinize software and computing infrastructure for potential vulnerabilities.

companyName: Crypto Co

ticker: CRCW


text: The Enterprise Risk Committee of the Board of Directors is responsible for the oversight of cybersecurity risk at the Company. The Company has established a Cyber and Technology Risk Appetite Statement, which is approved annually by the Enterprise Risk Committee. Changes in cybersecurity risk are monitored throughout the year and are reported to the Enterprise Risk Committee.

companyName: EVANS BANCORP INC


text: We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. As part of continuous improvement initiative, we strive to mature and build a robust and resilient environment to protect and defend against bad actors. We engage third parties to perform internal and external testing to improve security operations, disaster recovery, and incident response programs.

companyName: Argo Group International Holdings, Inc.


text: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: SLM Corp

ticker: SLM


text: The CSP is designed to assess and mitigate threats and risks to the Company. New and emerging threats are assessed through an intelligence lifecycle, which includes threat modeling. In addition, risk assessment processes drive risk identification and measurement related to security. Once risks are identified and measured, the Framework is leveraged to track and mitigate them. Control testing is utilized to demonstrate that risks are managed effectively, identify gaps in expected control operation, and develop appropriate remediation plans, in order to manage risk to the Company within tolerable limits.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the audit committee of the Board of Directors. The audit committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The audit committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. The audit committee receives periodic reports from our CISO and General Counsel, or GC, on material cybersecurity risks, developments in cybersecurity, ongoing priorities and work of the governance, risk, and compliance committee, or the GRC Committee, updated risk assessments of our cybersecurity program, and mitigation strategies. The GC is also tasked with reporting on material cybersecurity incidents, if any, to the audit committee.

companyName: Olo Inc.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, other members of executive management, and other personnel and advisors, as requested by the Board, report on our financial, operating, and commercial strategies, as well as significant related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: The policies and procedures established pursuant to the Program include: • Govern – Identify cybersecurity priorities and related outcomes as a component of the Company's strategic planning processes. • Identification – Identify and manage cybersecurity risk to systems, assets, data, people, and capabilities using measures such as asset management and assessment of suppliers and third-party partners, including using audits and testing. • Protection – Implementation of safeguards designed to ensure delivery of critical infrastructure services, including identity management and access control, security training, and use of protective technologies. • Detection – Detection of the occurrence of anomalies and cybersecurity events through logging, monitoring and communicating to appropriate personnel. • Response – Establishing appropriate responses when cybersecurity events are detected, including response planning and leveraging communications channels. • Recovery – Restore any capabilities or services that were impaired as a result of a cybersecurity incident, by executing documented recovery plans. Pursuant to the Program, the Bausch Health Information Technology Security Department develops specific cybersecurity policies, procedures and guidelines. Key cybersecurity risk drivers, mitigation strategies, and key updates are incorporated as part of our ongoing Enterprise Risk Management processes. Our executive management team is responsible and accountable for the Program, cybersecurity risks generally, and ensuring that appropriate resources are allocated to addressing such risks, with Board-level oversight from the Audit and Risk Committee of the Board of Directors. We review and seek to improve the Program through assessments from external, independent third parties, who review documentation, conduct interviews with key stakeholders, assess security roadmap progression and maturity against industry benchmarks, report on our internal incident response preparedness and help identify areas for continued focus. We also have insurance coverage for potential losses arising from a cybersecurity incident and to provide professional services that mitigate potential business impacts during cybersecurity incidents.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect our systems and sensitive data. This model is composed of a variety of different components including administrative controls, technical controls and other safeguards. These components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: While our Board has the ultimate oversight responsibility for the risk management process, the Audit Committee is responsible for oversight of our cybersecurity strategy and risks. The Audit Committee is provided with quarterly and as needed updates on the Company's cybersecurity strategy and risks. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.

companyName: CTS CORP

ticker: CTS


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such cybersecurity incident responses are overseen by leaders from our Information Security, IT, Finance, Compliance and Legal teams.

companyName: CITIZENS, INC.

ticker: CIA


text: In the event of a cybersecurity incident, the IT Director and ISO would become aware of the incident or potential incident through their own detection, detection by us, detection by a third-party consultant, or, in the case of a cybersecurity incident occurring on a system administered by a third party, through notification from that third party. Upon becoming aware of a cybersecurity incident or a potential cybersecurity incident, the IT Director and the ISO, in collaboration with the information security team, other employees, and external consultants as needed, would work to mitigate any impact of the incident or potential incident. The IT Director and the ISO would also inform the OTC of an incident or potential incident.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: Our board of directors maintains oversight of our most significant risks and our processes to identify, manage and mitigate those risks. The audit committee of our board of directors (the "Audit Committee") has responsibility for oversight of our management of cybersecurity risks.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Reporting directly to our General Counsel, our Data Protection Officer has primary day-to-day responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. With close to 25 years of experience in the fields of cybersecurity and data protection, our Data Protection Officer joined the Company in 2019.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Compliance Committee and management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Compliance Committee actively participates in strategic decisions related to cybersecurity. This involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: While we have never had a material cybersecurity incident that impacted our operations, we face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; employee threats; virtual and cyber threats to our directors, officers, and employees; threats to the security of our facilities and infrastructure; and threats from terrorist acts or other acts of aggression. Our customers and vendors face similar threats. We utilize internal and external independent controls to monitor and mitigate the risk of these threats. All our key business processes utilize third-party software platforms. We do not retain any sensitive customer information outside of these systems.

companyName: PARKS AMERICA, INC

ticker: PRKA


text: Our Board of Directors is responsible for overseeing cybersecurity threats, among other things. Our Chief Technology Officer, who reports to our Chief Executive Officer and President, provides our senior management and our Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: The Company's information security program is managed by a dedicated Chief Technology Officer ("CTO"), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's Cybersecurity Incident Response Committee (the "CIRC"), which is comprised of the Company's CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Vice President of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.

companyName: MP Materials Corp. / DE

ticker: MP


text: We mitigate risks from cybersecurity threats by applying multiple layers of defense to ensure we have the continued ability to access or utilize an asset or its value, and deny threat actors the ability to gain or increase their access to an asset or its value. We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: FIS takes actions to assess, identify, and manage risks from cybersecurity threats to our information systems and those of our vendors and technology partners. A significant focus of our ongoing efforts is how we identify these vulnerabilities and prevent and respond to cyberattacks. Our processes include the activities of the FIS Cyber Fusion Center, which provides 24x7x365 cybersecurity threat monitoring and response. They also include structured defense-in-depth initiatives, such as perimeter security, remote access security, endpoint security, application security and identity management. In addition, we engage in extensive information security training of our employees who use and access our information systems. Our process for identification and management of risks from cybersecurity threats includes regular communication with cyber experts, engagement of cybersecurity partners to review our systems, regular audits of our information security by third-party assessors and consultants, and regular interactions with vendors and technology partners to oversee and identify material risks associated with the information systems utilized by such persons.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response plans; vulnerability management plan; disaster recovery and business continuity plans; segregating and encrypting certain of our data; maintaining network security and access controls; asset management, tracking, and disposal; monitoring certain of our systems and network; penetration testing and tabletop exercises; cybersecurity insurance; having dedicated cybersecurity staff; and training our employees about certain cybersecurity risks and threats.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our VP of IT, with the oversight of our Chief Financial Officer. Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our VP of IT, in consultation with our Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our VP of IT has over 25 years of relevant experience, including leadership roles in the information technology departments of public and private companies. Prior to joining Vital Farms, he served as VP of IT for another public company in the consumer packaged goods industry.

companyName: Vital Farms, Inc.

ticker: VITL


text: The risk management committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are a consistent focus of the Company and that the Company's cybersecurity efforts are aligned with the overall risk management framework. We have also implemented cybersecurity training at all levels of our organization and conduct periodic phishing assessment for our employees to reinforce that training.

companyName: National Storage Affiliates Trust

ticker: NSA


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Urban One's cybersecurity program is led by the CIO and CISO, who are responsible for cybersecurity strategy, risk management, and incident response. The CISO collaborates closely with the CIO, IT leadership, and business stakeholders to align security initiatives with the Company's broader strategic objectives.

companyName: URBAN ONE, INC.

ticker: UONE


text: The Company's cybersecurity program is led by the Company's Chief Information Officer (the "CIO"), who has served in such role since October 2018. Our CIO has over 25 years of experience in the technology industry, which includes experience in data security and cybersecurity. Prior to joining the Company, our CIO ran a web tech consulting company serving small- and medium- sized businesses in healthcare and other industries.

companyName: JANEL CORP

ticker: JANL


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and leverage testing by our internal audit team, tabletop exercises, and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. The results of these assessments are reported to our Audit Committee.

companyName: Danimer Scientific, Inc.


text: The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats that we may face in our operations and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of Information Technology and our Senior Director of Information Security. The topics reported by the

companyName: Mueller Water Products, Inc.

ticker: MWA


text: A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Our cybersecurity risks and related responses are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by our Board of Directors. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our internal and customer facing information technology systems and confidential information. As part of this program, we prioritize maintaining the highest cybersecurity standards to safeguard information stored within our information technology systems. Our cybersecurity framework and controls are designed to align with key aspects of recognized best practices and standards for cybersecurity and information technology including industry standards based upon guidelines from the Center for Information Security ("CIS") and the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF"). Additionally, we incorporate guidance from the Federal Financial Institutions Examination Council ("FFIEC") to ensure we meet the expectations of our partners and any applicable regulatory requirements.

companyName: BM Technologies, Inc.


text: Our cybersecurity risk management processes are integrated as part of our overall enterprise risk management (ERM) processes. Our Audit Committee conducts its oversight of our cybersecurity risk management as part of its oversight of our enterprise risk management policies and procedures. In addition, we conduct an annual survey of over 150 Ingredion business leaders across multiple functions and geographic locations that asks them to evaluate the potential severity and likelihood of cybersecurity matters, among other enterprise and information technology risks. We solicit their views on information and data security protection against cyber and internal threats, reliability of systems including disaster recovery related to malware or other cyber threats, and system implementation failures, and use the responses to modify our risk mitigation strategies accordingly.

companyName: Ingredion Inc

ticker: INGR


text: In an effort to remain vigilant against cybersecurity attacks, the Company further provides annual and ongoing training to all of its employees so that they have an understanding and appreciation of the cybersecurity environment and risks and the Company's policies to combat such risks. Such training includes annual mandatory training sessions on cybersecurity for all employees, periodic informational notices regarding emerging threats, and periodic testing to ensure employees are reporting suspicious activities and are diligent in their efforts to avoid phishing attacks and cybersecurity breaches. The CISO also conducts and participates in annual table top exercises with management and on occasion, with representatives from the Board, in order to be prepared in the event of a material cybersecurity event.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Additionally, as a public company, we are subject to various regulatory requirements around our internal controls, including our controls around our information technology systems and their impact on our financial statements or systems. We have engaged a third party vendor to advise us on our compliance with these requirements, including around our controls related to cybersecurity, and strategies to mitigate related risk. If we were to identify any control deficiencies that represent cybersecurity risks, those would be reported to the Chief Financial Officer and the audit committee, together with plans for corrective action, as appropriate.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: The Board of Directors has overall oversight of key risks, with strategic oversight of cybersecurity risk management delegated to the Audit Committee. Annually, the Audit Committee reviews the Company's enterprise risk management, which includes cybersecurity. In fiscal year 2024, the Audit Committee established an IT Audit Subcommittee to enhance focus on IT-related internal controls and cybersecurity. The Board and Audit Committee have appointed one of its independent directors and members of the Audit Committee to sit on the IT Subcommittee. This subcommittee meets quarterly with key company leaders to review cybersecurity risks and audit findings and reports regularly to the Audit Committee.

companyName: STAR GROUP, L.P.

ticker: SGU


text: The Company's risk management program includes governance through the cybersecurity committee, consisting of senior executive management team along with legal and other key holders. Our Enterprise Risk Management lead is tasked with integrating any cybersecurity risk considerations into overall risk management strategy. Risk management includes regular risk assessments to identify internal and external risks and to evaluate the magnitude of harm that could arise out of such risks. Further, risk management may utilize third party service providers where complementary and supplementary to the Company's overall business strategy. Lastly, risk management includes training and education over the continuously evolving landscape of cybersecurity threats. We engage external parties, including consultants, independent privacy assessors, computer security firms, training service providers and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the ISO 27001, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and other relevant standards.

companyName: Aeries Technology, Inc.

ticker: AERT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Callaway Golf Co

ticker: CALY


text: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA). Personnel from the MSSP hold several certifications, including but not limited to: Certified Information Systems Security Professional ("CISSP"); ITIL Foundations; Fortinet Certified Network Security Administration and Professional; and Microsoft Certified IT Professional, Technology Specialist, Solutions Associate. The external risk advisory and accounting firms that we use to perform our audits and assessments described above utilize personnel qualified as one or more of the following to perform our audits and assessments: Certified Information Systems Auditor (CISA), CISSP, Certified Information Security Manager (CISM), and Certified Information Technology Professional (CITP).

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Assess We evaluate the exposure of our assets to identified cyber risks and the potential impacts on our operations or reputation if we were unable to access or utilize an asset or realize its value, or if a threat actor gained access to an asset or its value. We also assess the potential materiality of these risks based on their potential impact on our operations or reputation.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Strategy and Risk Management To mitigate cybersecurity risks we have adopted a process of continuous improvement and adaptation to the ever-changing threat landscape. As part of this process, we engage with industry-leading managed security service providers to supplement our efforts in preventing, identifying and responding to cybersecurity threats. Our information technology operations, information security processes and CIRP are generally aligned with the National Institute of Standards and Technology's framework.

companyName: JBG SMITH Properties

ticker: JBGS


text: The Company's Audit Committee and board of directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's CISO and Chief Information Officer ("CIO") provide quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. These include a variety of mechanisms, controls, technologies, methods, systems, written policies, physical safeguards, along with the use of third-party consultants and experts, that are reasonably designed to protect our information, and that of our stakeholders, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: SILVERBOW RESOURCES, INC.


text: The Company's Information Security Policy ("Policy") is based upon the ISO 27001, HITRUST CSF, SOC 2 Type 2, and PCI DSS frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company. The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes. It addresses the Company's procedures and controls for, including but not limited to, asset and data management, user access and authentication, personnel education/trainings, change management, risk management, system configurations, security monitoring and reporting, vulnerability management, and business continuity and disaster recovery. The Policy applies to all employees, consultants, contractors, and other such persons ("Personnel") with access to the aforementioned processes, equipment, hardware, and software. The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: To control cyber risks at third parties and protect customer data and systems, PNC assesses suppliers and third parties through a third-party security program that includes periodic security assessment. The third-party security program also includes regular monitoring of certain third parties using an independent security rating service that is designed to ensure insight and alerting is available at scale. In the event of an incident at a third party, there are specific incident response processes and protocols in place that are designed to protect PNC from potential adverse impacts.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Audit Committee and the Board of Directors provide oversight of cybersecurity risk management. The cybersecurity risk management program is co-led by senior leaders of our management and third-party service providers. Between our senior leaders, there is a combined 30+ years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our Director of IT leads the IT organization, reports directly to the Chief Financial Officer and works closely with the President and Chief Executive Officer to guide strategic direction and IT decisions to drive business outcomes. Our Board of Directors is engaged in the Company's Enterprise Risk Management (ERM)

companyName: Electromed, Inc.

ticker: ELMD


text: Cybersecurity Incident Impact As previously disclosed, in August 2021, we experienced a cybersecurity incident that resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits. In January 2023, we experienced another cybersecurity incident that also resulted in consumer class actions and regulatory inquires. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. For additional details regarding the impact of both cybersecurity incidents, see Note 17 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: We have a Data Incident Response Plan ("the Plan") which provides for controls and procedures in connection with cybersecurity events including escalation procedures as summarized below. Under the Plan, we have established a Data Incident Response Team (the "Response Team"), a cross-functional group comprised of certain members of senior management, including our Chief Legal Officer and CISO. The Plan provides that the Response Team is responsible for assessing, investigating and responding to any cybersecurity event elevated for its consideration by our CISO.

companyName: YUM BRANDS INC

ticker: YUM


text: We understand the importance of identifying and managing cybersecurity risks that could materially disrupt our business operations. We rely on information technology systems to conduct important operational activities and to maintain business and employee records and financial data. Disruption of these systems could adversely impact our ability to conduct business activities.

companyName: Five Point Holdings, LLC

ticker: FPH


text: In fiscal year 2024, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.

companyName: STERIS plc

ticker: STE


text: The CISO has extensive cybersecurity knowledge and skills, gained from over 20 years' experience working in regulated industries. The CISO holds a number of cybersecurity related certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager. In addition to the CISO, the CTSO has been a close partner and advocate for cybersecurity at the Company, and is consulted or informed on all decisions or risks that affect the Company's technology systems and/or implicate cybersecurity. The CAO is responsible for overseeing the cybersecurity team at the executive leadership level.

companyName: MOODYS CORP /DE/

ticker: MCO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity prevention and mitigation efforts will always be successful, and it is possible that cybersecurity threats could have a material adverse effect on our business, operations, or financial condition in the future. See "Risk Factors—Risks Related to Our Business Operations and Industry—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity." under the heading "Risk Factors" of this Form 10-K.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: To further ensure independence and effectiveness, the Board has delegated authority for the Information and Cybersecurity Policy and Program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Management's Role Managing Risk The Senior Director of IT plays a pivotal role in informing the Audit Committee on cybersecurity risks. This role provides briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: The Board of Directors of the company (the "Board"), primarily through its Audit Committee, oversees the company's cybersecurity program. The company's CIO and CSO regularly report to the Audit Committee on the current state of the company's cybersecurity program (including the current threat landscape, cybersecurity risks, and any significant incidents). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for enhancements that the Audit Committee deems appropriate.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: A critical component of the Fund's cybersecurity program is its incident response plan. This plan includes a requirement to evaluate the materiality of any data incident. Should the evaluation conclude that the data incident rises to the level of materiality it will be incumbent for the Fund, working with the Investment Adviser and legal and cybersercurity professionals, to describe the data incident within four business days of determining that an incident is material. The Fund shall also be responsible to provide ongoing reporting about the status of the material data incident until such time that the material data incident is no longer a factor with respect the Fund's operations.

companyName: Wellings Real Estate Income Fund


text: Our external security expert has over thirty years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: an IT and security team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and mitigation measures, and (3) our response to cybersecurity incidents;

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments. The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company takes steps to identify and oversee risks from cybersecurity threats associated with our use of such entities and the Chief Compliance Officer ("CCO") of the Company reviews cybersecurity-related reports provided by key service providers.

companyName: BC Partners Lending Corp


text: We use the ISO 27001 standard as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications or requirements.

companyName: Oscar Health, Inc.

ticker: OSCR


text: The Company established a risk-based strategy informed by guiding principles from industry standard cybersecurity and risk management frameworks, such as those published by the National Institute of Standards and Technology (NIST). The Company's cybersecurity risk management framework is integrated with the Company's Enterprise Risk Management ("ERM") process that is subject to oversight by the Board. Cybersecurity risks are one of the key risks regularly evaluated, assessed and monitored as part of the Company's overall ERM process.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity software providers and penetration testing firms. These third-parties also provide application and hosting services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and audits for each vendor and a review of each such vendor's written security program.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: External Reporting of Cybersecurity Matters We have adopted protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated and, where appropriate, reported promptly to the public. We have empowered a cross-functional team of management to determine whether established reporting thresholds have been met and whether public disclosure is necessary or required.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices, which are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards, are fully integrated into our overall risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

companyName: Enova International, Inc.

ticker: ENVA


text: We regularly engage third-party services to conduct evaluations of our security controls, which can include penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and effectiveness of security controls.

companyName: CXJ GROUP CO., Ltd

ticker: ECXJ


text: We continuously test and assess our cybersecurity posture, including through annual third-party risk assessments performed by reputable assessors, consultants and auditors. A global FAIR (Factor Analysis of Information Risk) assessment is conducted at least annually to update our cybersecurity risks and corresponding mitigations.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Sigyn Therapeutics, Inc.

ticker: SIGY


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board of Directors, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.

companyName: Ellington Financial Inc.

ticker: EFC


text: Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.

companyName: Kayne DL 2021, Inc.


text: Our cybersecurity processes to assess and identify cybersecurity risks includes periodic risk assessments, deployment of security monitoring tools for continuous monitoring of our information systems, periodic testing for vulnerabilities in our systems, periodic testing of employees' cybersecurity awareness, receiving cybersecurity alerts, among other procedures. Our Information Security ("IS") department, which reports to the Vice President, Information Security, evaluates cybersecurity risks and works to design and ensure implementation of appropriate controls and safeguards in alignment with our business objectives and operational needs. Management periodically reviews cybersecurity risks as part of the overall risks to the company as part of the enterprise risk management program. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: MEDIFAST INC

ticker: MED