text: Based on an assessment using the previously described enterprise information security program, we do not believe that there are any risks from known cybersecurity threats, including as a result of any prior security incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled " The loss of personal, confidential, and/or proprietary information due to our cybersecurity systems or the systems of our customers, vendors, or partners being breached could cause us to incur significant legal and financial exposure and liability, and materially adversely affect our business, operating results and reputation," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TechTarget, Inc.

ticker: TTGT


text: Our Head of Global Supply Chain and IT, reporting to our Chief Executive Officer, has principal responsibility for assessing and managing cybersecurity risks and preparing updates for the Board of Directors. Our Head of Digital Business Services reports to our Head of Global Supply Chain and IT and is responsible for the operation of our cybersecurity program. Our Head of Digital Business Services is educated in business computing sciences and has over twenty years working in leadership, management, and consulting roles in digitalization, application management, and cybersecurity. Our Head of Digital Business Services also has experience implementing and leading global governance frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and ISO 27001. An Advisory Board, comprised of the Chief Executive Officer, Chief Financial Officer, Head of Global Supply Chain and IT, and Head of Digital Business Services, meets quarterly to discuss digital initiatives and investments, inclusive of cybersecurity topics. An experienced team of IT security professionals reports to our Head of Digital Business Services.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD

secItem: Item 1C


text: The ERM program inventories and classifies key risk areas. We employ a methodology for scoring the risks based on the probability and impact of individual risks and discuss and implement countermeasures to address the risks.

companyName: TransDigm Group INC

ticker: TDG


text: f. Our cybersecurity incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, communicate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: In addition, Keysight maintains information security risk insurance, which may help to offset the costs of an information security breach. The policy is reviewed annually and updated as needed. We also engage with approved third-party companies that review our regulatory compliance, validate control performance, perform penetration testing, and provide impartial risk assessments.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: e.reports from senior management and/or appropriate external subject matter experts related to the monitoring and analysis of the Company's current threat environment, vulnerability assessments related to cybersecurity risk management, and existing and expected future trends related to cybersecurity relevant to the organization; f.the Company's cyber-resiliency, including cybersecurity crisis preparedness, incident response plans, communication plans, and disaster recovery capabilities;

companyName: MANNATECH INC

ticker: MTEX


text: The Company's data security framework integrates technical solutions, policies, controls, data governance, and employee training. Key components of our framework include strong encryption, access control, regular updates, data backup, and endpoint security. The Company is also currently implementing features within its AWS environment, such as Security Hub, and is committed to compliance with HIPAA and SOC 2. The Company continuously researches alternatives to its current framework, recognizing that cybersecurity presents an ever-evolving challenge.

companyName: Brand Engagement Network Inc.

ticker: BNAI


text: Our Board administers its risk oversight role directly and through its committee structure. While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity. Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, Global Privacy Officer, our cyber, information security, and data privacy risks and programs. This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management's actions to identify and detect cyber threats and incidents, results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance. Our management team also provides updates to the Board as needed. For instance, during the December 2022 cybersecurity incident, our Board and Audit Committee were regularly updated, and our Audit Committee provided oversight and feedback with respect to management's investigation of, and response thereto, including internal and third-party investigations, public or governmental disclosures and our remediation efforts.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Dow has comprehensive processes to manage cybersecurity risks when engaging with third-party service providers, including reviewing questionnaires and independent quantitative scores of the vendor's cyber hygiene, maintaining robust controls to address and mitigate significant risks that may arise, and performing ongoing assessments and reviews throughout the duration of the engagement.

companyName: UNION CARBIDE CORP /NEW/


text: Our chief information officer meets at least annually with the risk committee of our board of directors and/or the full board of directors to provide them with updates on IT matters, including cybersecurity. At least two members of our Board of Directors have IT and cybersecurity experience or expertise, including the chairs of our audit committee and risk committee. While our board of directors is ultimately responsible for risk oversight at our company, the risk committee of our board of directors assists the board in fulfilling its oversight responsibilities by reviewing risks in certain areas, including cybersecurity.

companyName: B&G Foods, Inc.

ticker: BGS


text: Under our Cybersecurity Program, our information technology team and our senior management, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to manage those risks. Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third-party information technology system providers. When cybersecurity incidents occur, our actions are guided by an incident response plan to (i) detect, contain and eradicate threats, (ii) notify executive management and the Chairman of the audit committee as appropriate based on the severity level of the cybersecurity incident, (iii) recover compromised data and information systems, (iv) limit impacts of any such incident on our operations and (v) report any such incident as required by law or as otherwise appropriate.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Our board of directors receives reports from our Director of Information Technology on cybersecurity matters on as needed basis. These reports can include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee of our board of directors (the "Audit Committee") also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates. The Chair of the Audit Committee reports to the full board of directors on these discussions as appropriate.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained, with assistance from a third-party service provider. These policies and procedures and the resulting safeguards are designed and evaluated in light of our risk assessments. We have implemented access controls, firewalls, and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes to safeguard our information systems. We maintain a business continuity and disaster recovery plan designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when hired and based on periodic phishing tests.

companyName: VERU INC.

ticker: VERU


text: The Company's CISO reports directly to the CIO, who in turn reports to the CEO. The CISO maintains the certified information systems security professional (CISSP) certification and has over 22 years of experience in cybersecurity. Under the direction of the CISO, the Company's information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2024, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, refer to Risk Factors in Part 1, Item 1A of this report.

companyName: SM Energy Co

ticker: SM


text: Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cybersecurity training, cyber-attack simulations and tabletop exercises with senior management to detect control gaps.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Supply chain risk is being evaluated in an ongoing manner with our comprehensive Third-Party Risk Management program. We use a variety of tools to monitor key Software as a Service provider's security positions as well as regular Risk Assessment questionnaires and evaluations.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: For additional information on our cybersecurity risks, please see Item 1A " Risk Factors—Risks Related to Our Business and Structure—A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts."

companyName: Cardiff Lexington Corp

ticker: CDIX


text: The Technology Committee also participates in strategic decisions by the Board of Directors by offering recommendations regarding significant investments or initiatives that could impact the Company's cybersecurity. This involvement is meant to promote the integration of cybersecurity considerations into the broader strategic objectives of the Company by helping the Board of Directors remain aware of the role information security has in the Company's broader risk management framework.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We have robust programs in place for assessing, identifying and managing material risks from cybersecurity threats. Our approach leverages a comprehensive suite of security tools and initiatives, including but not limited to, Managed Security Service Providers, Extended Detection and Response monitoring, internal reporting mechanisms, and advanced detection and monitoring tools. Our information security program is continuously evaluated through internal audits and a range of security exercises, including tabletop simulations, penetration testing, vulnerability assessments and red team exercises. Identified security gaps from these assessments are systematically integrated into our risk remediation processes and incorporated into our security tools and applications to enhance our overall cybersecurity policies and procedures. In addition, we conduct annual Payment Card Industry Data Security Standard compliance reviews and independent third-party penetration testing to ensure our defenses remain resilient and aligned with industry best practices.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: The Audit Committee of our Board of Trustees provides board-level governance and oversight regarding cybersecurity matters. Management meets with the Audit Committee periodically to discuss cybersecurity strategy, risk, trends, and internal personnel and qualifications. As part of our annual enterprise risk assessment, technology and cyber risks are standing risk factors which are ranked and reviewed by management.

companyName: JBG SMITH Properties

ticker: JBGS


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework that has been established by the enterprise risk management team.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: We have implemented cybersecurity measures and processes to address and mitigate material risks from cybersecurity threats. We utilize the services of third party providers to develop, maintain, and implement cybersecurity systems and measures designed to protect our information systems from unauthorized access and damage. AgeX security measures are periodically assessed, tested, and updated. We do not have employees with information technology or cybersecurity expertise and accordingly we obtain an assessment of our cybersecurity systems and measures from a third party provider different from the provider that is primarily responsible for installation, update, and maintenance of information technology and cyber security systems. Our information technology and cybersecurity service providers primarily interface with members of our accounting and finance group. These processes are an integral part of our internal controls and risk management and the results of the third party assessment are reported annually to the Audit Committee along with a report from management on the effectiveness of are not aware of the occurrence of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that material cybersecurity incidents will not arise or be discovered in the future.

companyName: Serina Therapeutics, Inc.

ticker: SER


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Maitong Sunshine Cultural Development Co., Ltd

ticker: MGSD


text: • Reviewing significant investments and expenditures the Company proposes to make to manage or mitigate enterprise risks and make recommendations, where appropriate; • Reviewing reports and presentations from management and the Company's advisors, including outside cybersecurity and privacy experts, regarding the management of cybersecurity and privacy risk programs; • Reviewing and addressing, as appropriate, management's corrective actions for deficiencies that arise with respect to the effectiveness of the Company's cybersecurity and privacy risk management programs; • Reviewing and discussing with management the Company's public disclosures in its SEC reports relating to the Company's cybersecurity and privacy matters, including privacy, network security and data security, including reviewing applicable cybersecurity and privacy disclosures in the "Risk Factors" section of this 2023 Form 10-K; • Reviewing the adequacy of the Company's cybersecurity insurance programs to determine if the coverages are sufficient, consistent with market conditions, to protect the Company; • Reviewing, with the Company's General Counsel or their designee, any cybersecurity and/or privacy-related legal matter that could have a significant impact on the Company's business or reputation; and • Addressing other matters as the Cybersecurity Committee Chair or other members of the Cybersecurity Committee determine relevant to the Cybersecurity Committee's oversight of cybersecurity and privacy risk assessment and management.

companyName: Cano Health, Inc.


text: Our cybersecurity management team, which is led by our Chief Information Officer ("CIO") and Director of Cybersecurity, consists of members who have extensive experience in cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for implementing our overall cybersecurity risk management program, including ongoing monitoring, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Director of Cybersecurity have extensive cybersecurity experience as noted below.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Westwood relies on its Board, in conjunction with senior management members, to ensure ongoing success of its cybersecurity environment. Our Board's responsibilities include, but are not limited to: a. Overseeing effective implementation of our cybersecurity initiatives and alignment with agreed policies and strategies;

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks, with assistance from third-party service providers. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through training.

companyName: Dakota Gold Corp.

ticker: DC


text: We have an in-depth approach to monitoring and addressing cybersecurity risk. Members of management together with our Board, the Cybersecurity and Data Privacy Committee of the Board(the "Cybersecurity Committee"), our internal Cybersecurity and Data Privacy Steering Committee (a cross-functional team which includes members of our Executive Leadership Team), and the Enterprise Risk Management team (a task force comprised of senior representatives of the company assessing risk in the organization), have developed cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: HASBRO, INC.

ticker: HAS


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Chief Financial Officer is primarily responsible for assessing and managing material risks from cybersecurity threats on a day to day basis.

companyName: Kairos Pharma, LTD.

ticker: KAPA


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to senior management and the Technology Committee of our board of directors, as well as the full board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: The Senior Director of IT has relevant expertise in cybersecurity having spent the previous five years prior to joining the Company implementing and managing ISO 27001 at a public biotechnology company, where he was responsible for cybersecurity and Sarbanes-Oxley Information Technology compliance, reporting directly to the Audit Committee. ISO 27001 is the International Organization for Standardization's standard for a comprehensive cybersecurity program. The Senior Director of IT also has extensive SOX IT compliance experience, having guided his previous companies through SOX IT compliance since 2004 when SOX first came into effect.

companyName: Third Harmonic Bio, Inc.


text: Our cybersecurity risk management efforts have also been integrated into the overall risk management process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as business downtime, loss of Company's financial assets or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our risk management process have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated periodically and communicated to our executive leadership.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Our Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's Incident Response Plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: Tempus AI, Inc.

ticker: TEM


text: Our Board has oversight of our strategic and business risk management, including cybersecurity risk management, with support from our Audit Committee (described under "Governance" below). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: CELESTICA INC

ticker: CLS


text: We conduct quarterly cybersecurity reviews with our executive leadership team. The review outlines the state of cybersecurity practices at Centuri through the lens of the NIST Cybersecurity Framework ("NIST CSF"). Details relative to the progress of specific goals and objectives are communicated to ensure alignment with leadership expectations. We have developed policies and implemented procedures to meet the security control objectives provided within the NIST CSF, as well as applicable Centuri policies. Our cybersecurity team performs a variety of internal operational risk assessment activities to track and mitigate risks to the organization. These operational practices cross a variety of management activities, and a list of these activities is maintained in a Cybersecurity Risk Register for tracking the status of risk mitigation activities, as well as the overall maturity of the organization relative to the NIST CSF. We further engage third parties to perform both targeted and holistic evaluations of our cybersecurity practices on a regular basis.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: Our management team, including our Chief Information Security Officer ("CISO"), is responsible for addressing, assessing, and managing our material risks from cybersecurity threats. Our CISO supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants (when applicable). Our management team's experience includes demonstrated expertise in cybersecurity, mobile and data devices, and smartphone software. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: DNA X, Inc.

ticker: SONM


text: At this stage, the Company has not established formal Board-level committees dedicated to cybersecurity; however, management, led by our Chief Executive Officer, President, Subsidiary Chief Executive Officers and Chairman, oversees day-to-day cybersecurity operations and engages external specialists as needed.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Internally, the cybersecurity program is managed by the Company's Senior Vice President, Chief Information Security Officer and Chief Information Officer. She has held senior management positions in information technology, management information systems and information security for over 30 years. She reports regularly to the risk and audit committees of the Board of Directors about the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, the full board annually assesses all critical risks of the Company, including cybersecurity risks, and also receives periodic updates relating to key cybersecurity issues as part of their oversight.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: As of the date of this report, we do not believe that risks from any cybersecurity threats as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, we are aware that changes in our IT systems, including those provided by third parties, could expose us to risk in the future. We cannot guarantee that controls we will implement to mitigate this risk will eliminate it. See Item 1A of this Annual Report for discussion of this risk.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Cyber Enviro-Tech, Inc. is committed to protecting its information systems, customer data, and operational infrastructure through a robust cybersecurity framework. Risk Assessments: Continuous monitoring of threats and vulnerabilities. Incident Response: A structured plan for rapid mitigation and resolution. Third-Party Security: Due diligence on vendors and partners. Regulatory Compliance: Adherence to industry standards and legal requirements. Encryption & Access Controls: Secure storage and restricted access. Employee Training: Awareness programs on cyber threats. Breach Response: Rapid containment, forensic analysis, and regulatory notifications. Advanced threat detection systems. Regular penetration testing. Collaboration with cybersecurity experts.

companyName: Cyber Enviro-Tech, Inc.

ticker: CETI


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which includes the Information Security Manager/Officer assisting with and evaluating cybersecurity readiness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.

companyName: California BanCorp


text: Our enterprise risk management program reports at least quarterly to the Management Risk Committee and considers cybersecurity threat risks alongside other types of risks as part of our overall risk assessment process. The Management Risk Committee consists of those members of executive management of the Company with ultimate responsibility for the Company's enterprise risk management practices. Members of the Management Risk Committee regularly engage in discussions and meetings relating to cybersecurity risk management and strategy processes and the prevention, detection, mitigation and remediation of cybersecurity incidents. Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. Our cybersecurity risk management and strategy processes are led by the Chief Information Officer, who is a member of the Management Risk Committee, and the Vice President of Network Services.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: The Chief Information Officer holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as a senior technology leader or Chief Information Officer of two public companies and two private equity-owned firms. The Chief Information Officer has prior experience supporting organizations that have experienced cybersecurity events and continue to learn more about the current trends and risks by partnering with third parties.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Virtu's Cybersecurity Program is driven by a threat analysis, laying out standards and requirements pertaining to, but not limited to, penetration testing, endpoint protection, incident management, access controls, mobile security, data classification, third-party access, encryption, system hardening and patching, vulnerability management, passwords, data destruction, physical security, and vendor risk assessment. We also conduct training and awareness exercises to mitigate employee-related cyber risks. In addition to these elements of the Cybersecurity Program aimed at mitigating risk, the Company has developed an Incident Management procedure that addresses escalation and reporting of security incidents in the event that they do occur and has conducted various cross-functional table top exercises to develop and refine a coordinated response plan. The Company also maintains insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber-related incidents. These processes are intended to identify and remediate cybersecurity incidents, and also provide the framework for our proactive identification, assessment, and management of potentially material risks from a wide range of cybersecurity threats. Risks identified through these processes are identified to and evaluated by our CISO, who periodically reports to our Board and Risk Committee as described below on any such risks determined by the Global Security team to be potentially material.

companyName: Virtu Financial, Inc.

ticker: VIRT


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on quarterly updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity threats or incidents, if any. As part of these quarterly updates to the Audit Committee, our Vice President of Information Technology presents any developments, emerging risks or key topics to the Audit Committee, including, among other things, the external threat environment, risk profile changes, training initiatives, the status of projects to strengthen cybersecurity, emerging global policies and regulations, cybersecurity technologies and industry practices, cyber readiness, results of third-party assessments, mitigation efforts and response plans. The full Board of Directors receives regular reports from the Chair of the Audit Committee, as well as periodic updates highlighting recent incidents throughout the industry and the emerging threat landscape.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: from Cybersecurity Threats of the date of this report, there have been no cybersecurity incidents that have materially affected our results of operations or financial condition.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: We manage our risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by the Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. The Company seeks to prioritize the management of cybersecurity risk and the protection of confidential information and systems, and the Company's program and processes are based on industry standards as guided by the National Institute of Standards and Technology ("NIST") framework. Under the supervision of the Chief Financial Officer ("CFO") and our Director of IT, we regularly work to identify all computing assets including hardware, software, and network infrastructure in order to conduct a risk assessment. We consider threats that may originate from both internal and external sources and maintain technical security controls internally. To identify risks, we complete vulnerability assessments on a recurring basis to help proactively identify potential weaknesses. We additionally engage a third-party vendor to conduct external and internal penetration testing on a periodic basis in order to assist in identifying additional vulnerabilities in our environment. We also perform business continuity planning and disaster recovery exercises throughout the organization annually by our in-house team.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: In the event of a reported potential cybersecurity incident, GIS determines whether such incident triggers our cybersecurity threat evaluation and response plan (the "Response Plan"). If triggered, our cybersecurity response team, which includes representatives from GIS, our business team, and executive leadership, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team are responsible for developing, recommending and implementing the necessary measures to address the cybersecurity incident, including assessing, containing and mitigating its impact, notifying members of our management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The Cyber Response Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: Our suppliers and third-party service providers are subject to cybersecurity obligations. Prior to engagement, we assess the cybersecurity posture of third-party service providers who store, process, or transmit Air Products' information. In many cases, our agreements include requirements for suppliers and other service providers to notify us if they suffer a cybersecurity incident that may affect us.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Our cybersecurity risk management program includes: • an internal security team, led by our Chief Information Security Officer, or CISO, which is responsible for, among other matters, monitoring our platform through penetration testing and vulnerability scanning, managing our cybersecurity risk assessment processes, and implementing our security controls; • an annual risk assessment performed by our internal security team designed to identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity incident response plan, or IRP, that establishes an organizational framework and guidelines to assist us in identifying, responding to, and recovering from cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with other services, such as performing third-party penetration testing, assisting with incident response, and facilitating adversary simulations; • annual cybersecurity awareness training for our employees and additional training for engineers, technical team members, members of the cybersecurity incident response team, or CSIRT, and our Board of Directors; • a third-party risk management process for service providers and vendors, which includes review by the internal security team at onboarding and, for certain significant vendors, an annual security review; and • an insurance policy to help mitigate, in certain circumstances, potential liabilities resulting from cybersecurity incidents and other cyber issues.

companyName: Olo Inc.


text: Our Manager's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: We have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. Please refer to the risk factor captioned "We could be subject to losses and reputational harm if we, or our agents, fail to properly safeguard sensitive and confidential information against cyberattacks or other security breaches or if our business processes are not sufficiently resilient." in Part I, Item 1A. Risk Factors, for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: CREATIVE MEDICAL TECHNOLOGY HOLDINGS, INC.

ticker: CELZ


text: Our associates, including those responsible for cybersecurity, are evaluated for competence, including the knowledge and skills necessary to accomplish tasks that define associates' roles and responsibilities and undergo regular training regarding security-awareness, privacy, ethics and compliance. Our job summaries contain specific educational and knowledge requirements necessary for cybersecurity jobs. In addition, a criminal background check is completed for all new associates and performance reviews are conducted annually to measure performance results and achievements and to assess the job competency of our associates.

companyName: Elevance Health, Inc.

ticker: ELV


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting guidelines. Decisions regarding the disclosure and reporting of such incidents are made by management in a timely manner. The Board of Directors and Audit Committee receive ongoing updates regarding any such incidents until they have been addressed. The Audit Committee regularly interacts with the Company's ERM function, the Company's Vice President of Information Technology, other members of management and relevant management committees, including the Company's Security Advisory Board and Cybersecurity Incident Response Team. On a quarterly basis each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland and the Sub-Advisor. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of our Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer (CTO) is responsible for leading the assessment and management of cybersecurity risks, oversees teams across the Company supporting our cybersecurity policies and procedures around prevention, detection, mitigation and remediation of cybersecurity incidents, and reports at least quarterly to the Audit Committee on cybersecurity strategy and risks. Our CTO has over 25 years of experience in cybersecurity and information technology, is the Chair of the Real Estate Board of Cyber Committee, a Board Member of the Real Estate Cyber Consortium and is a Board Member of the Global Cyber Consortium.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: For additional information, see "Item 1A—Risk Factors." In the last two reporting years, we did not experience any material cybersecurity incidents or threats.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: PTC takes a holistic, multi-layered approach to cybersecurity and privacy that combines traditional Defense-in-Depth methods with next-generation Zero Trust principles. In today's globally interconnected world, we consider every entry point on the attack surface critical, and we aim to secure the points under our control. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II and FedRAMP, for certain of our products and services.

companyName: PTC INC.

ticker: PTC


text: Through a combination of security, risk and compliance resources, AB implements Information Security through a dedicated Information Security Program ("ISP") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by our Chief Information Security Officer ("CISO") who actively partners with our Chief Compliance Officer ("CCO") and Chief Risk Officer "("CRO"). Ultimately, our ISP is part of our full enterprise risk framework, which includes information technology, business continuity and resiliency, in addition to cybersecurity risk. Our ISP is coordinated with our broader risk management team, including our Chief Security Officer. Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: The CISO and other members of the Security Governance Committee are selected from the Adviser's business groups. The CISO has over 20 years of cybersecurity and technology management experience.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and based on risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis and corporate governance. For additional details about our management team and their experience, refer to the Executive Leadership page on the Company's website at https://www.amphenol.com/governance/leadership.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Material Effects of Cybersecurity Threats Cybersecurity risks have the potential to materially affect the Company's business, financial condition and results of operation. The Company has strengthened its cybersecurity framework in recent years but the sophistication of emerging cyber threats and the utilization of new attack methods continues to evolve. The Company's cybersecurity risk management and strategy may not protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: To date, we have not experienced any known cybersecurity incidents that have materially affected or are reasonably likely to materially affect us in the future, including our business strategy, results of operations, or financial condition.

companyName: TELEFLEX INC

ticker: TFX


text: The Sponsor has an information security program and policy in place, as mandated by New Regulation S-K Item 106. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Funds.

companyName: Teucrium Commodity Trust

ticker: CANE


text: In connection with improving the management of cybersecurity risk, the Company has: audited our systems with the help of information security consultants; completed ransomware simulations and enhanced our Disaster Recovery and Business Continuity Plan to reflect lessons learned;

companyName: AGREE REALTY CORP

ticker: ADC


text: Management's role in assessing, monitoring and managing our material cybersecurity risks is primarily the responsibility of our CISO, reporting to our CFO. Both the CISO and CFO rely on third party experts, including consultants, auditors, and cybersecurity assessors regarding cybersecurity strategies and processes. The CISO manages vendor work related to cybersecurity, and has primary responsibility for the evolving cybersecurity roadmap, remediating known risks, and leading our employee training program, pursuant to which we provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices. Our management has also developed security policies and processes which include regular system updates and patches, employee training on cybersecurity and privacy requirements, incident reporting, and the use of encryption to secure sensitive information. In addition, we also regularly perform phishing tests of our employees and update our training plan at least annually. We maintain business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and/or the loss of data and services from the effects of natural or man-made disasters to our physical operations.

companyName: electroCore, Inc.

ticker: ECOR


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: The Partnership has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Partnership's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Partnership's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.

companyName: CVR PARTNERS, LP

ticker: UAN


text: The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Security Officer ("CSO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The Company's CSO has 23 years of work experience in the cybersecurity field throughout various industries, including the utility sector, and has obtained several professional certifications, including from the International Information System Security Certification Consortium. The CSO reports directly to the Company's Chief Information Officer ("CIO"), who is responsible for the Company's information technology program. The CIO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's CSO, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CIO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CIO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CIO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Our processes for assessing, identifying and managing information security risks and vulnerabilities are embedded across our business as part of our ERM program. As part of ERM program, we perform risk assessments in which we map and prioritizes information security risks identified and addressed through a multi-faceted approach of processes described here, including third party assessments. We execute periodic audits and tests of our information system security controls in-house such as a vulnerability analysis of the information and the infrastructure of our sites. We engage third-party services to assist in designing the ITGC controls and evaluating them periodically either through independent audits or consulting on best practices to address new challenges. These evaluations include both the design and operational effectiveness of the controls. Our risk management program also assesses third party risks, and we perform third party risk management to identify and mitigate risks from third parties such as vendors and suppliers associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers. Among other things, we conduct periodic infrastructure monitoring including assessment of existing technology hardware and software configurations, patches and updates and also implement automated tools. We provide recurrent information security awareness training for employees and carry out periodic campaigns related to safety awareness which include interactive activities involving the employee participation. Additionally, we have also implemented incident management protocols to analyze, remediate, and respond to activities that implicate potential risk to data and information. Through this methodology we remediate information security incidents and comply with potential legal obligations mitigating brand and reputational damage.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and are part of our operating procedures, internal controls, and information systems. These risks include, among other things, operational risks; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: The Incident Response Team provides periodic reports to our Data Privacy and Security Committee, as well as our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on the Company's cybersecurity risk management program, assessments of current cybersecurity risks, and status updates for projects designed to enhance our information security systems. Our Data Privacy and Security Committee meets to further discuss such items on a monthly basis and reports periodically to the Audit Committee of the Board of Directors.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We, directly and through our third-party service providers, maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats.

companyName: LUXURBAN HOTELS INC.

ticker: LUXH


text: We have developed cybersecurity and data privacy programs designed to enable and safeguard the confidentiality, integrity and availability of our information systems and data by providing proactive security expertise and risk assessments, creating and maintaining a resilient and secure environment, and fostering a culture of security awareness and compliance throughout our organization. We maintain a robust Information Security Program that sets forth our commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing of, and protecting sensitive information, including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA).

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: Our CIO is responsible for our information security program and controls, which includes cybersecurity risk management. Our Head of Cybersecurity reports to our CIO, and leads our cybersecurity program and team that assesses, manages and monitors cybersecurity risks, associated risks of emerging technologies, and the corresponding controls. The CIO and Head of Cybersecurity have extensive cybersecurity knowledge and expertise, skills gained from each having over 20 years of relevant industry experience.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Results of testing If applicable, security incidents and/or breaches or violations of law or regulation and management's response to such incidents; and Recommendations for updates and improvements to the overall information security program.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: In the last ten years, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business, financial condition, cash flows and results of operations. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, financial condition, cash flows and results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents could materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "We face continually evolving cybersecurity and similar risks, which could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption to our business, damage to our brands and reputation, legal exposure and financial losses," which is incorporated by reference into this Item 1C.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Helios' VP, Information Technology is an active member of InfraGard and has formal education in information technology with over 25-years' experience in roles involving management of cybersecurity functions, cyber strategy, and leading and collaborating on information systems and related technologies. The VP, Information Technology receives regular updates on cybersecurity developments, results of mitigation efforts and cybersecurity incident response and remediation through monthly Advanced Threat Intelligence briefings and FBI bulletins via Infragard.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, and any expenses incurred from cybersecurity incidents have been immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Operational Matters".

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: Members from our legal, finance, internal audit and technology leadership comprise a management committee on cybersecurity (the "Cybersecurity Risk Committee"), which is primarily responsible to assess and manage our material risks from cybersecurity threats. The composition of our Risk Management Committee reflects a diverse and comprehensive range of expertise, critical for overseeing the effective evaluation and management of potential material cybersecurity risks within Yext. Members of the Cybersecurity Risk Committee hold advanced degrees in key fields relevant to our risk management efforts, including computer science, information security assurance, business administration, engineering, as well as legal, finance, and accounting disciplines. This combination of specialized knowledge and experience, reinforced by industry recognized certifications in these areas, positions the Cybersecurity Risk Committee to effectively evaluate and manage potential material cybersecurity risks.

companyName: Yext, Inc.

ticker: YEXT


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to a risk assessment incorporating elements of industry standard frameworks, penetration testing, endpoint detection and response, and system monitoring. We have an employee training program that includes annual cybersecurity awareness training that is reinforced by approximately monthly phishing campaigns. We also maintain an incident response plan and related processes to help guide our response to cybersecurity incidents.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across the Company. Significant incidents are reviewed by a cross-functional and multi-disciplinary working group to determine whether further escalation is appropriate. Any cybersecurity incident that meets certain pre-established criteria is reported to our Executive Crisis Management Team ("ECMT"), which includes members of the Company's senior leadership team. The ECMT maintains an ongoing relationship with third-party advisors, such as forensic and incident management, crisis communications, and legal advisors, which we engage as necessary based on the specific facts of an incident. Incidents are evaluated to determine materiality for external reporting purposes as well as operational and business impact.

companyName: APi Group Corp

ticker: APG


text: Our business operations and relationships with consumers, customers, employees and business partners rely heavily on information technology ("IT") systems and data. We also recognize the need to continually assess cybersecurity risk and evolve our management approach in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including consumer, employee and confidential business records and information, against known and evolving cybersecurity threats. We have established processes for identifying, assessing, and managing material risks from cybersecurity threats using a systematic framework intended to protect the confidentiality, integrity, and availability of the Company's important IT systems and data. Oversight responsibility in this area is shared by the Board, its Audit Committee, and management.

companyName: V F CORP

ticker: VFC


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.

companyName: POOL CORP

ticker: POOL


text: Our management team, including our SVP of Digital and IT and our Chief Legal Officer, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team, including our SVP of Digital and IT and our Chief Legal Officer, are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our third party service providers. Cybersecurity events are escalated to our Board as appropriate. Our management team's experience includes developing and overseeing the information technology security program as head of the information technology department and certification from the National Association of Corporate Directors for the Cyber-Risk Oversight Program.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: We have developed a comprehensive information security program that is designed to protect and preserve the confidentiality, integrity, and continued availability of all information that we own or possess. The program is a critical component of our overall IT Security, Risk, and Compliance Management Program, which is based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: To stay ahead of potential cybersecurity challenges, the Company has established a formal process. This process is activated whenever the FFIEC CAT or the ISGC identifies changes in inherent risks. In response, the Company proactively updates its cybersecurity objectives, policies, and tactical goals. This ensures that the Company's cybersecurity strategy remains responsive, continuously adapting to emerging threats and evolving industry standards.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The Company has established a Management Technology Committee and a Board Technology Committee. These Committees provide oversight and governance of information technology and the Information Security Program and meet quarterly. The Board Technology Committee's responsibilities include: (1) monitoring the strategic deployment and usage of Information Technology throughout the Company using reports and presentations from management;

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: The Information Security Officer has the primary responsibility for managing the Program to identify, assess, manage, and control cybersecurity risk. The Information Security Officer reports directly to the President. The Information Security Officer has approximately 16 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.

companyName: F&M BANK CORP

ticker: FMBM


text: Our incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Mr. Gharib and the Chief Executive Officer. Mr. Gharib works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.

companyName: CapForce Inc.

ticker: OPGN


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Legal and Administrative Officer leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • a continuous, four-phase Enterprise Risk Management (ERM) process of risk program development, risk assessment and prioritization, risk response, and risk validation and monitoring designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, such as penetration (pen) testing, and to otherwise assist with aspects of our cybersecurity processes and controls; • focused, annual, and mandatory risk management education for our employees and leaders, including cybersecurity awareness training, multiple cybersecurity and phishing awareness campaigns throughout each year, and tabletop exercises; • regular assessments of the design and operational effectiveness of the program's key processes and controls by management, our internal audit team, and third-party experts; and • a risk management process for third-party service providers and vendors not under our direct control that includes pre-selection due diligence and validation, and post-selection periodic monitoring to manage cybersecurity risks and monitor adherence to applicable cybersecurity standards.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Key maintains an Information Security Program (the "IS Program") to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key's clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key's information assets. Our Chief Information Security Officer (" CISO "), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key's Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.

companyName: KEYCORP /NEW/

ticker: KEY


text: Index to Financial Statements Managing Material Risks & Integrated Overall Risk Management We take an integrated approach to assessing and identifying cybersecurity risks and threats. At the corporate level, cybersecurity is identified as a key risk within our Enterprise Risk Management (ERM) program. Our management of cyber risk is based on the National Institute of Standards and Technology's (NIST) cybersecurity framework. While the NIST cybersecurity framework is our foundation, we combine that with the Center for Internet Security's (CIS) control framework.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: We regularly review and update our investments in information technology security to identify and protect critical assets, provide monitoring and alerts, and, as needed, engage third-party experts. To assess the effectiveness of our program, we have engaged consultants to conduct penetration testing and other vulnerability assessments. Additionally, our Internal Audit department and external auditors conduct assessments of different systems to provide the Audit Committee with information on our risk management processes, including cybersecurity risk management. We also test our defenses internally and conduct regular cybersecurity simulations and tabletop exercises with members of senior management present. These tests and assessments provide useful insights into the strengths and weaknesses of our cybersecurity framework.

companyName: UNION BANKSHARES INC

ticker: UNB


text: deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems of the cybersecurity risks posed by interacting with current and potential third-party service providers, suppliers and customers..

companyName: AiXin Life International, Inc.

ticker: AIXN


text: In July 2023, the SEC adopted amendments intended to enhance and standardize disclosures related to cybersecurity. The amendments were effective in December 2023 and require timely disclosure of material cybersecurity incidents and annual disclosures related to cybersecurity risk management, strategy, and governance. Under the new rules, a material cybersecurity incident is required to be disclosed on a Form 8-K within four business days after the learning of a material incident. The SEC has defined a cybersecurity incident to mean "an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein." Arrow has undertaken and implemented a number of procedures and control steps to comply with these expanded cybersecurity reporting requirements as outlined below.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Information Technology leads our cybersecurity program, reporting directly to the Chief Operating Officer ("COO") and provides reports and updates to the Audit Committee, the Enterprise Risk Committee and the Chief Risk Officer ("CRO") quarterly or more frequently as required.

companyName: BayCom Corp

ticker: BCML


text: We rely on third-party information technology vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our own and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions or statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us nor are they reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, including within the last three years, these incidents have not had a material impact on our Company, including our business strategy, results of operations or financial condition. Risks from cybersecurity threats, including previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, are also not currently viewed as reasonably likely to materially impact our Company, including our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflicts and developments and technological advancements also increase the risk and likelihood of cyber incidents. As such, we must commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. Although we have implemented and maintain commercially reasonable security measures and safeguards, including to protect against and identify potential threats, these protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: Our Chief Financial Officer is responsible for managing cybersecurity risk. With the assistance of outside consultants, he develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring as well as to reduce the impact of any such incident, should it occur. At least annually, he discusses cybersecurity risk and the Company's mitigation efforts and effectiveness of controls with the Audit Committee of the Board of Directors, which is the committee that has primary responsibility for overseeing our risk assessment and is composed solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risk and reviews the tests of controls performed by consultants that perform the internal audit function. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full Board of Directors.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: The adoption and deployment of AI in our, and any third-party collaborators' operations, and in particular our and any third-party collaborators' R&D efforts to explore new targets and develop effective products, may not be effective and may expose us to risk;

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by Blue Owl's IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing the monitoring and alert response processes, vulnerability management, changes made to critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.

companyName: Blue Owl Real Estate Net Lease Trust


text: Our Chief Information Officer ("CIO"), who has over 35 years of experience in the technology field, oversees cybersecurity, data privacy and manages Asbury's information and security procedures. Asbury also has a Director of Cybersecurity, as well as a formal team of analysts.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Our Science and Technology Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Science and Technology Committee receives reports on information security and cybersecurity from the Company's information technology managers at least four times a year.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: HPE, like all organizations operating in the technology landscape, faces significant and persistent cybersecurity risks. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected us, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity program, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could reasonably likely materially affect us. Additional information on the cybersecurity risks we face can be found in the section titled "Risk Factors" in Item 1A of Part I of this Annual Report on Form 10-K.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and Executive Vice President of Operations, and Head of Internal Audit has broad oversight of the Company's risk management processes. The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO invites team members from the product and technology groups to attend each Cybersecurity and Governance Council meeting to report on ongoing or relevant cybersecurity and compliance matters. The Cybersecurity and Governance Council reports any material developments to the Audit Committee on a quarterly basis.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: We also actively monitor our systems and connections for abnormal activity, including malicious phishing attempts. This includes the use of intrusion detection systems, log analysis, and real-time monitoring of critical systems. We have an incident reporting portal available to all employees to submit any issues they suspect may pose a risk to our information technology ("IT") systems and security.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: Our General Counsel and Assistant General Counsel – Compliance drive the program. The executive leadership team, including our Chief Executive Officer, and the Company's management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing managing and mitigating risks. With respect to cybersecurity risk, our legal and compliance team works closely with our IT leaders to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Cornerstone Building Brands, Inc.


text: For additional discussion of certain risks associated with cybersecurity, see "Risk Factors" under the heading "Cybersecurity risks could affect the Company's operating effectiveness."

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: Threats can come from many sources, including, but not limited to, ransomware, malicious software, credential loss or theft, supervisory control and data acquisition system takeover, equipment theft, supply chain attacks, phishing attacks, identity-based attacks, denial-of-service attacks or the actions of employees either intentional or accidental. Ransomware whereby hackers take control of a company's systems and/or data has been identified as the most significant threat to Registrant's critical infrastructure systems and is getting harder to detect and encrypted files are becoming harder to recover. Threat actors using ransomware have also increased their use of data, not only for direct ransom and data destruction, but also to release the data to the public. Registrant believes a breach of customer personally identifiable information is one of the most significant financial risks to it as the costs incurred could exceed the amount of its cybersecurity insurance coverage. Nevertheless, in order to continue meeting Registrant's technological business needs and as more vendors build solutions in the cloud, Registrant expects to further expand its use of cloud-computing environments. As such, Registrant expects risks from cyberattacks and data breaches to increase due to the growth of its technological footprint in the cloud environments.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: In the event of a material breach or an information technology disruption, management has an incident response team in place to take immediate action, work with local and national law enforcement, and notify the appropriate regulators, our Board of Directors and impacted parties. In addition, we would work with the NYSE to disclose the scope and effect of the breach or disruption through an appropriate Form 8-K filing, without providing information that could affect any law enforcement investigation.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: The Information Technology (IT) Department of Cullman Savings Bank is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The IT Department is managed by the Vice President IT ("VP IT"). She has more than 13 years of experience with Cullman Savings Bank and a degree in Management Technology. The VP IT also oversees our Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and brings awareness, accountability, and oversight for data protection throughout Cullman Savings Bank. Our program and with trusted third parties help ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going threat assessments, addresses the latest threats and conducts penetration, business continuity/ disaster recovery testing, and incident response plan testing. The VP IT presents information security and cybersecurity updates on a weekly basis to the Operations Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer and the Information Security Officer (ISO).

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Our management team, including our CDIO, CISO, Vice President and Deputy General Counsel – Chief Privacy and Data Protection Officer, Vice President of Infrastructure and Operations and additional members of the ECRG are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our management team has extensive information technology experience, as well as cybersecurity incident response, compliance, oversight, and program management experience. Additionally, certain leaders and personnel within the cybersecurity organization hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: AMERICAN AIRLINES, INC.


text: We have established procedures for monitoring network activities, detecting anomalies and responding to cybersecurity incidents promptly. We engage a specialized managed services firm to provide continuous monitoring and an initial level of incident response. We work with a leading cyber forensics firm to provide incident response services as needed. Our incident response and escalation procedures are documented to classify incidents according to defined thresholds. Our core incident response and extended incident response teams are cross-functional and include leaders across technology, legal, finance, asset protection, customer care, human resources, stores operations and communications. Protocols to notify our executive leadership team and Board are in place based on the severity of the incident.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. Internal reporting and escalation protocols are in place to ensure the involvement of the SVP, IT, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Material Cybersecurity Incidents As of September 30, 2025, we were not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank, including its business strategies, results of operations or financial condition. For more information on our cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third Parties, and Technology".

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Role of the Board and Management The Company's board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk, at least annually. The board has delegated responsibility for oversight of the Company's cybersecurity, information security framework, and risk management to the Company's management cybersecurity committee (the "Cybersecurity Committee"). Pursuant to its charter, the Cybersecurity Committee must consist of at least four members of the Company's executive management team, which shall include the Company's director of technology, chief operating officer, chief compliance officer, and chief financial officer, each of whom is required to have working familiarity, knowledge, and competencies in relevant areas, including data privacy, public policy, information technology ("IT") strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company's director of technology has formal education in IT and extensive experience working in and leading the Company's information systems and technology function.

companyName: Cohen & Co Inc.

ticker: COHN


text: Our CIO, who reports directly to the CEO, has significant professional experience including senior technical leadership roles at public companies and m aintains the certified information systems security professional (CISSP) certification. Under the direction of the CIO, our information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks and conducts regular enterprise-wide training on cybersecurity threats for all employees. This analysis drives our long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the department and are communicated to the board of directors regularly.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: External Assessments We obtain periodic assessments by third party experts of our vulnerability management and security controls and to assist us in identifying and mitigating security risks.

companyName: Alpha Teknova, Inc.

ticker: TKNO