text: We rely on our technology infrastructure and information systems for our internal communications, controls, reporting and relations with customers and suppliers, to utilize our data, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Risks from Cybersecurity Threats As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, incidents impacting data processed and systems maintained or operated by us or on our behalf, and incidents otherwise impacting our operations, can and do occur. For example, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our EXOGEN device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. As a result of the Change Healthcare incident, certain of our patient billing and collections processes were disrupted. We have identified an alternative claim processing intermediary and have resumed claims submissions, but this incident caused delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us. As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data. We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows. We continue to evaluate the impact of the Change Healthcare incident on our Company.

companyName: Bioventus Inc.

ticker: BVS

secItem: Item 1C


text: The Company's Chief Financial Officer and VP of Finance are responsible for the oversight and communication of cybersecurity threats and risks to the Company's Board of Directors. They meet regularly with the Board of Directors where a Cybersecurity roadmap progress is shared with the board.

companyName: Drilling Tools International Corp

ticker: DTI


text: After receiving notice of a cybersecurity threat, such threats are investigated to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire ISC is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct legal and forensic investigations and work with other third parties who might be engaged to assist in any response and associated publicity.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board is responsible for oversight of our cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols, while our FSO and IT Manager are responsible for assessing and managing cybersecurity risk. We use a third-party service which monitors the Company's security threats twenty-four hours each day throughout the year. Any detected deviation from the expected operating parameters will initiate a communication to our IT Manager for investigation and remediation of the detected deviation in a timely manner. Our IT Manager has over 30 years of IT and cybersecurity experience.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or as needed. Our Audit Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Containment—perform short-term containment, for example by isolating the network segment that is under attack. Then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: As part of our risk management program, we continuously assess risks from third parties, including vendors, suppliers, and other business partners associated with our use of third-party service providers.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: Management of our cybersecurity team has extensive experience and training related to cybersecurity matters. These leaders hold top-secret clearance from the U.S. federal government and have attended classified briefings from relevant federal agencies. Our cybersecurity team has in excess of 100 years of combined cybersecurity experience as of year-end 2024, and members of the team hold various specialized certifications related to cybersecurity, including training related to penetration testing and information system auditing.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: The Task Force ultimately provides information to our Audit Committee regarding its activities, including those related to cybersecurity risks. The Audit Committee also receives a briefing and continuing education from a member of the Task Force relating to our cyber risk management program at least annually. The Task Force is responsible for notifying the Audit Committee of material cybersecurity incidents.

companyName: MARA Holdings, Inc.

ticker: MARA


text: The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers.

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: We have experienced, and may in the future experience, whether directly or through our third-party service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Refer to "Item 1A. – Risk Factors" in this Annual Report on Form 10-K, including, "We may be subject to interruptions or failures in our information technology systems," for additional discussion on our cybersecurity related risks.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: Our cybersecurity incident response processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Director Infrastructure, Operations and Cyber Security, who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Our product cybersecurity officer (PCO), under the direction of our chief technology officer, leads our cybersecurity program for our products and services and is responsible for assessing and managing related cybersecurity risks. Our PCO updates the Special Activities Committee on cybersecurity risks as they relate to our products and services, in addition to updates on product and service cybersecurity incidents, defenses and mitigation strategies.

companyName: RTX Corp

ticker: RTX


text: We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our critical data includes confidential, personal, proprietary, and sensitive data, collectively our "Information Assets". Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: Leatt Corp

ticker: LEAT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process—Our business and operations may suffer in the event that our information technology systems, or those used by our CROs or other contractors or consultants, fail or suffer security breaches."

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. The Company uses a blend of people, process, and technology controls to manage and mitigate cybersecurity risk. The Company's Board of Directors delegates oversight of the Bank's processes for identifying, assessing, and mitigating material risks, including cybersecurity risks, to the Board Audit and Risk Management Committee. Senior Leadership, including the CTO and CRO, manage third-party service providers and advisors to maintain and continuously enhance the Bank's Information Security Program. The CTO, CRO, and the Bank's third-party virtual ISO regularly present to the Board Audit and Risk Management Committee on the state of cybersecurity at the Bank, including any business-impacting incidents and emerging industry risks. The virtual ISO has over 30 years of experience in IT, Information Security, Business Continuity, and Technology Risk in the Financial Services sector and maintains several industry-recognized security, audit, privacy and governance certifications.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: The Information Technology Committee, in turn, reviews reports on our cybersecurity risk management processes. These reports cover assessments of management's handling of cybersecurity threats and incident management functions. The committee receives periodic updates from the chief information officer, including information on social engineering risks, the effectiveness of cybersecurity training, and results from vulnerability and penetration assessments conducted both internally and by external parties. Audit reports related to information systems and cybersecurity threat monitoring are also part of this reporting process.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: Our security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and senior director of global information technology. Our CFO works with our IT department to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to our board of directors for certain cybersecurity incidents.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: The Company's cybersecurity program is designed to be aligned to the Cybersecurity Framework published by the National Institute of Standards and Technology ("NIST CSF"). While we use the NIST CSF as a guide, this does not imply that we meet any particular standards, specifications or requirements. We conduct regular internal and external assessments of our information security and cybersecurity programs, including periodic external audits for company-wide compliance with our program as well as specific business unit alignment, as required, with U.S. federal acquisition regulations and UK Cyber Essentials certifications. An external penetration test is performed annually against the Company's network, in addition to our regular internal vulnerability scans.

companyName: IDEX CORP /DE/

ticker: IEX


text: Our risk assessment efforts have indicated that we are a potential target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized criminal groups, malicious insiders and activists. The impacts of attacks, abuse and misuse of the Company's systems and information include, without limitation, loss of assets, operational disruption and damage to the Company's reputation.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Cyber Risks Related to Third Parties Risks from cybersecurity threats associated with its use of third-party service providers are addressed as part of the information security risk and third-party risk domains, and their management is integrated into the ERM Framework. To help control cyber risks at third parties and protect customer data and systems, PNC assesses suppliers and third parties through a third-party security program that includes periodic security assessment. The third-party security program also includes regular monitoring of certain third parties using an independent security rating service that is designed to ensure insight and alerting is available at scale. In the event of an incident at a third party, there are specific incident response processes and protocols in place that are designed to protect PNC from potential adverse impacts.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Our cybersecurity program is an integral part of our overall risk management framework and is aligned with recognized industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber threats. Our program safeguards the confidentiality, integrity, and availability of our systems and data through a comprehensive and multi-layered approach.

companyName: HEICO CORP

ticker: HEI


text: The governance framework is closely integrated via a structured compliance reporting framework operating across various governance levels. This framework also operates across geographic locations, with location specific compliance meetings conducted at a local management level and led by the CISO with assistance from the ISO team. This structured compliance reporting is intended to ensure that the highest levels of management are kept abreast of potential cybersecurity risks facing the Company, with the escalation of significant cybersecurity matters to the Audit Committee and ultimately to the Board of Directors, as appropriate.

companyName: INNODATA INC

ticker: INOD


text: The electric utility industry is an identified critical infrastructure function with mandatory cybersecurity requirements under the authority of FERC. The NERC, which FERC certified as the nation's Electric Reliability Organization, developed mandatory critical infrastructure protection cybersecurity reliability standards. AEP's service territory covers multiple NERC regions and is audited at least annually by one or more of the regions. AEP has participated in the NERC grid security and emergency response exercises, GridEx, for the past ten years and continues to participate in the bi-yearly exercises. These NERC-led efforts test and further develop the coordination, threat sharing and interaction between utilities and various government agencies relative to potential cyber and physical threats against the nation's electric grid. AEP also conducts internal exercises to test and further refine AEP's cyber response plans. These internal scenarios are chosen based on real world events and often include coordination with and communication to AEP's Chief Executive Officer and executive team.

companyName: AEP Transmission Company, LLC


text: Our full Board of Directors and our Audit Committee provide oversight of our risk management program, which includes cybersecurity and monitoring the performance of our third-party IT providers. The Audit Committee, as part of its charter to review the Company's practices with respect to risk assessment and risk management, receives updates on internal control, including those relating to IT general controls and cybersecurity.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: daily maintenance, emergency response support, maintenance report preparation, major IT project support, etc. and (iv) provide support for the operation and maintenance of various IT infrastructure, and ensure the stability of the company's IT infrastructure. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we maintain third-party risk management efforts designed to help protect against the misuse of information technology and security breaches, including requirements in the agreements with such third parties.

companyName: Future FinTech Group Inc.

ticker: FTFT


text: Engagement of Third Parties Given the complex and evolving nature of cybersecurity threats, the Company engages third parties to assist us in developing and maintaining effective cybersecurity risk management. Partnering with third parties enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023, we engaged a global law firm to conduct an external assessment of our cybersecurity governance framework and processes and provide recommendations to improve our cybersecurity readiness and posture. We also work with third party specialists who perform threat and vulnerability assessments, audits and develop strategies to mitigate cybersecurity-related risks.

companyName: ENTEGRIS INC

ticker: ENTG


text: the use of external service providers, where appropriate, to assess, monitor, test or otherwise assist with aspects of our security controls and response to cybersecurity incidents; and a documented framework and supporting processes for handling security incidents that facilitates coordination across multiple parts of the Company.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: We seek to leverage a comprehensive risk management program that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity policy and strategy, and provides guidance to senior management.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Risk Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.

companyName: LAKE SHORE BANCORP, INC.


text: Our cybersecurity risk assessment and risk management processes are managed by certain Company management, including our CFO (who has prior experience in strategic business operations). Our CFO has supervisory responsibility over IT and cybersecurity functions. Our Company management is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for and respond to cybersecurity incidents, and reviewing security assessments and other security-related reports. Our incident response team is responsible for remediating cybersecurity incidents of which they are notified.

companyName: Annexon, Inc.

ticker: ANNX


text: In 2024, we did not identify any cybersecurity events that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: FRP HOLDINGS, INC.

ticker: FRPH


text: The Information Technology team is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy are led by our Vice President of Information Technology, and our Manager of Security. Such individuals have over 50 years of work experience, collectively, in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Our management team, including, among others, our Chief Financial Officer, General Counsel and Vice President of Risk Management, has overall responsibility for assessing and managing our material risks from cybersecurity threats and plays an integral role participating in direct oversight of information and cybersecurity risks. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained third-party cybersecurity consultants. The management team works closely with our Vice President & Head of Technology, as well as the Director of Cybersecurity and Technology Operations who has over eight years of experience in IT security, industry certifications, specialized training, and over fifteen years of experience in commercial real estate technology.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: Our cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our critical third-party service providers.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and employee and other personal data ("Information Systems and Data").

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; cybersecurity awareness and spear-phishing resistance training of our employees, and senior management;

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: All employees play a critical role in managing cybersecurity risk. Our Enterprise Risk Management Framework utilizes the three lines of defense model to define roles and responsibilities to effectively manage risk. First line employees own and manage risk, the second line oversees, monitors, and reports risk, and the third line provides independent assurance of risk management activities.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Senior Director of Information Technology, who has worked in various roles responsible for securing networks and application systems, the Chief Executive Officer, the General Counsel, the Interim Chief Financial Officer, and the VP of Finance and Administration. These members of management are responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. When incidents are identified, these members of management are responsible for determining whether such incidents are material and may escalate material incidents to the Audit Committee and/or investors, based on the particular circumstances.

companyName: Pulmonx Corp

ticker: LUNG


text: Continuous Improvement: Commitment to continuous improvement is reflected in regular reviews, updates of risk assessments, and simulated cyberattacks to identify and remediate risks from existing and emerging threats.

companyName: Paragon 28, Inc.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with Enterprise Risk Management, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT Steering Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: We face various cybersecurity threats as a prominent target, including denial-of-service attacks, ransomware, phishing, and advanced persistent threats. As an aerospace and defense company providing advanced defense technologies and services to the U.S. and foreign governments, these threats are not just from low-level threat actors, but rise to the level of sophisticated threat actors from organized and funded adversaries, including groups affiliated with various nation states. Our customers, suppliers, subcontractors, and vendors also face similar threats. Cybersecurity incidents impacting us, or any of these third parties, could have a material adverse effect on our operations, financial condition, and results of operations. Given the cybersecurity risks we face, we dedicate ample resources to addressing and mitigating our cyber risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Because we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. At a minimum the monitoring includes annual assessments by our Chief Information Security Officer ("CISO"). This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our ISO. The ISO's experience includes prior leadership roles within the Company, where they developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies. The ISO and other information systems staff possess in-depth knowledge and experience which are instrumental in developing and executing our cybersecurity strategies. The ISO and the Tech Steering Committee oversee our governance programs, work with our technology-focused leaders and partners to align security and compliance, and have developed our employee security awareness training program.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: We do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our overall business strategy, results of operations, or financial condition. While we have mitigating and compensating controls in place to protect against what we believe are some of the most significant types of cybersecurity threats that our business faces, such as ransomware attacks, denial of service attacks, theft of resources and unauthorized use or disclosure of customer data or confidential information, if such an event were significant and successful, it would be reasonably likely to materially affect our business strategy, results of operations, or financial condition by, for example, causing substantial disruptions to our product offering, services or support or incurring significant costs to mitigate and remediate the damage caused by such an attack. For information regarding cybersecurity risks that may materially affect our Company, see Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding cybersecurity and other risks we face.

companyName: Akili, Inc.


text: The Board of Directors plays a crucial role in overseeing our management of cybersecurity risks. The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Information Officer, internal information security team, and third-party experts. These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and our response to significant incidents.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Each of our Markel Ventures businesses maintains its own, separate IT infrastructure, that often includes third-party providers, to support the needs of its business. As a result, cybersecurity risk for the Markel Ventures businesses is not concentrated in one system or service provider. Further, given the disparate nature of the businesses, systems, and providers, there is no single, uniform approach to managing cybersecurity risk at the Markel Ventures businesses – each is tailored to its unique needs. As is the case with all risks, management for each Markel Ventures business is responsible for evaluating and managing cybersecurity risks for its business. Therefore, each business determines the appropriate IT systems and providers needed to do so.

companyName: MARKEL GROUP INC.

ticker: MKL


text: To manage and remediate cybersecurity risks identified as part of our ERM process and to manage emerging cybersecurity threats in real time; we have implemented a Managed Detection and Response system that supports the Security Operations Center. We are a member of the DoD Defense Industrial Base Collaborative Information Sharing Environment and the National Defense Information Sharing and Analysis Center. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Our Chief Information Officer, who reports to the Chief Executive Officer, has over twenty years of experience in IT, including IT security. In addition, one of our Board members, Hatem Naguib, is the President and Chief Executive Officer of Barracuda, a cybersecurity solutions provider, and brings expertise in IT security.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: Our cybersecurity program includes an incident response plan. Our incident response plan addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. We train our team members on cybersecurity risks and mitigation and retain experienced third-party cybersecurity consultants prepared to assist us in the event of any breach. For material cybersecurity risks, we've developed mitigation measures to reduce each risk's likelihood of occurrence and/or its expected impact. Such mitigation measures have involved, among other things, implementing additional technology controls or policies, increased training for Company personnel, and obtaining additional insurance for the identified risk. Our Information Technology ("IT") team monitors material risks over time and updates the Company's mitigation measures as appropriate. The IT team also regularly reports to the Company's leadership team on the status of material risks, mitigation measures, and incidents related to such risks. In addition to our incident response plan, we perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our IT team engages in threat modeling, vulnerability scanning and penetration testing.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: Our Board of Directors has charged the Audit Committee with the governance and oversight of this risk. Our committee charter requires quarterly reporting to our Audit Committee by our Vice President of Information Technology covering key cybersecurity accomplishments, planned enhancement activities, and monitoring observations of the threat environment. Board experience in risk assessment has been enhanced with certification achievements specific to cybersecurity risk, providing us with the appropriate oversight for this evolving threat.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: Our cybersecurity risk management program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, which includes information about how to identify and report cybersecurity concerns and incidents. Our information technology organization also conducts phishing simulations and testing scenarios to help ensure compliance with our cybersecurity policies and procedures. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our information technology organization.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain, which also include, but are not limited to, open-source software in our application development processes, or those who have access to our customer and employee data or our systems. Addressing these risks is part of our enterprise risk management program. Cybersecurity risks affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our critical systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we may impose contractual requirements related to cybersecurity on certain third parties that could pose significant cybersecurity risk to us and require them to agree to audits as appropriate.

companyName: Sunrun Inc.

ticker: RUN


text: The Company has experienced risks from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of the information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies— A disruption, failure or breach of the networks or systems on which the Company relies, including as a result of cyber-attacks, could harm its business."

companyName: Curbline Properties Corp.

ticker: CURB


text: JFG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision, design, development and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis, as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues. Protective measures, where appropriate, include, but are not limited to, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring, hardware and software, and data erasure and media disposal. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").

companyName: Senior Credit Investments, LLC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: Confidentiality agreements with employees and third-parties may not prevent unauthorized disclosure of trade secrets and other proprietary information;

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The Compliance Committee is responsible for understanding the global risk landscape of the Company and for working to ensure that we have a compliance program in place designed to mitigate, manage and/or monitor risks. The Compliance Committee consists of, among others, our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO") and Chief Compliance Officer ("CCO"). The CCO has established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of senior members of the Company's Information Security Team and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with our information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is one aspect of the overall set of policies, procedures and techniques that we employ at the Company to manage risk. Many of the mechanisms for identifying, managing and reporting on cybersecurity risk are integrated into the Company's broader policies and procedures relating to risk management; however, due to the unique nature of cybersecurity risk, key aspects of our cybersecurity risk management program are intended to function on a stand-alone basis, including to ensure rapid escalation and response to cybersecurity incidents.

companyName: REDWOOD TRUST INC

ticker: RWT


text: We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis.

companyName: MARKETWISE, INC.

ticker: MKTW


text: We continue to improve our cybersecurity risk assessment program and activities for assessing, identifying and managing cybersecurity risks through industry standard security frameworks and leading practices, including risk assessments and remediations, software and services, continuous systems monitoring, vendor risk management processes, incident response plans, phishing simulations, employee training, tabletop exercises and communication programs, among other measures. We also employ processes designed to assess, identify, and manage the potential impact of a security incident at critical third-party vendors, service providers or customers or otherwise implicating the third-party technology and systems we use.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Features of the cybersecurity risk management program include: • Technology solutions designed to prevent, detect and mitigate cybersecurity incidents. • Review, testing and assessments of the Company's cybersecurity systems, both internal and using third party service providers with cybersecurity expertise. • Required cybersecurity training for employees to learn about data security, how to identify and mitigate potential cybersecurity risks and how to protect our resources and information. • Specialized security training for members of the risk management, cybersecurity and technology teams that includes information about evolving cybersecurity threats and new risk mitigation and detection technologies. • Processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including technology providers and cloud-based platforms. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and facilitates coordination and communication across multiple parts of the Company. • On-going assessment of the adequacy of the cybersecurity program.

companyName: PCB BANCORP

ticker: PCB


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with our information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, independent audits, risk assessments and security certifications. We have established processes to help identify and manage cybersecurity risks associated with the use of these third-party consultants and providers, which include the completion of due diligence before engaging with a third-party and assessments and reviews throughout the relationship.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: We have implemented a governance structure and processes to aggregate reported cybersecurity risks on behalf of Pega Cloud, Pega's software products, and the corporate environment. Our SSG is responsible for providing strategic direction for implementing and maintaining our cyber risk management program.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The CDIR team identifies, tracks, reviews, assesses, and takes actions over key cybersecurity risks including but not limited to: (i) third parties/vendors, (ii) cloud security, (iii) malicious code, (iv) our digital e-commerce channels and systems, and (v) our store technology. The CDIR team also undertakes enterprise architecture reviews, considers cyber defense and incident response findings, performs vulnerability scans, and assesses threats and performs landscape intelligence analysis.

companyName: lululemon athletica inc.

ticker: LULU


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item IA—Risk Factors—Risks Related to Our Business."

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: We draw on the knowledge and insight of external cybersecurity experts and vendors, and our Chief Technology Officer's experience in building solutions that are secure and compliant with our information security framework. OneMedNet leverages an array of security services and tools to secure OneMedNet information infrastructure and protect systems and information from unauthorized access. OneMedNet's products and solutions, including 3 rd party software and services such as hosted cloud based platforms are monitored by a healthcare cloud, security and compliance organization that provides a real-time dashboard to monitor for potential threats and vulnerabilities.

companyName: OneMedNet Corp

ticker: ONMD


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization ("ISO") 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.

companyName: FEDEX CORP

ticker: FDX


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents, including with respect to our commercial customers and vendors, that require us to make changes to our processes and implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that future threats and incidents could have a material adverse effect on our business strategy, results of operations and financial condition, even if the threat or incident is promptly identified and countermeasures are implemented. Such events could lead to direct financial loss or require the expenditure of significant amounts to obtain the release of critical data and/or restore our operating systems or those of our customers and/or vendors if the incident was the result of a security breach for which we are held legally responsible.

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: Payment Card Industry compliance and incident response. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role. Our CISO reports directly to the CIO who has over 20 years of technology leadership experience in various industries.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Busey's historical data indicates that while Busey has encountered cybersecurity threats and incidents, none have materially affected the Company. Still, Busey faces a number of cybersecurity risks in connection with its business, and it is possible that threats and incidents identified in the future could have a material adverse effect on Busey's business strategy, results of operations, and financial condition. For additional information on the risks that cybersecurity threats pose to Busey see " Item 1A. Risk Factors—Operational Risks."

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Business and Our Industry— Internal system or service failures could disrupt our business and impair our ability to effectively provide our services and products to our customers, which could damage our reputation and adversely affect our revenues and profitability." and " As a U.S. defense contractor, we are vulnerable to security threats and other disruptions that could negatively impact our business. "

companyName: Laser Photonics Corp

ticker: LASE


text: The Board of Directors and Audit Committee are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is composed of Board members with diverse expertise, including in risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.

companyName: City Office REIT, Inc.


text: The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts. In addition, the Company reviews controls implemented by its third-party service providers to ensure that the providers' controls have been designed to effectively mitigate cybersecurity risks that could affect the Company's systems. The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company's systems. The CIRT reviews the findings of these evaluations and will determine the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary. The Company's information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company's cybersecurity policy.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. We regularly engage with third-party consultants in connection with our cybersecurity risk management program, which is overseen by our Chief Operating Officer. The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. The Audit Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks.

companyName: Expion360 Inc.

ticker: XPON


text: The Company's Audit Committee oversees management's process for identifying and mitigating cybersecurity risks. Periodically, the CISO presents cyber incidents and risks to the audit committee as part of the board of directors ' oversight of risks from cybersecurity threats. The Audit Committee's oversight includes understanding existing and new cybersecurity risks and status on management's response and mitigation plans.

companyName: PUGET ENERGY INC /WA


text: Oversight and Governance Members of our senior management, including our Chief Executive Officer, Chief Financial Officer, and leaders from our legal and information technology functions, maintain responsibility for assessing and managing cybersecurity threats. This team has deep expertise in building and leading information systems and cybersecurity teams across a variety of institutions. Our Head of Information Technology has approximately 20 years of information security experience.

companyName: Prime Medicine, Inc.

ticker: PRME


text: When reviewing potential threats or cybersecurity incidents, our Board of Directors has delegated the authority to the Audit Committee to setup crisis incident management teams comprised of senior management and appropriate specialists. These crisis incident management teams report on an as needed basis to the Audit Committee and full Board of Directors to keep them informed and seek direction where necessary.

companyName: Clean Energy Fuels Corp.

ticker: CLNE


text: We assess, identify and manage material risks from cybersecurity threats through the cyber risk management program supervised by our Chief Informational Security Officer ("CISO"). The cybersecurity program utilizes our cloud security backbone along with complementary tools to identify, prevent, detect, respond to, and recover from cybersecurity incidents, including: • regular cybersecurity awareness training for employees and contractors on our policies and emerging risks from cybersecurity threats, as well as regular phishing awareness training; • internal and third party cybersecurity testing, including penetration testing of our information systems and devices; • protective and detective cybersecurity controls built into our systems and applications; • cybersecurity incident monitoring and response efforts, including our security breach incident response plan (the "Incident Response Plan"), to identify, assess, escalate, investigate, contain, and remediate incidents; and • disaster recovery and business continuity planning efforts.

companyName: DOC DR Holdco, LLC


text: In addition, in accordance with its Mandate, the Board receives a quarterly report from management regarding the principal risks inherent in the business of the Corporation, including appropriate crisis preparedness, business continuity, information system controls, cybersecurity and information security, and disaster recovery plans. These reports address a range of topics, including industry trends, benchmark and assessment reports, information security projects and updates on cyber related metrics, technology modernization, policies and practices, and specific and ongoing efforts to prevent, detect, and respond to internal and external critical threats.

companyName: CELESTICA INC

ticker: CLS


text: Security Competencies The Information Security Program oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. This level of competency is attained through regulatory examination, scheduled audits, internal risk assessments, security scanning of assets and annual testing. We participate in annual programs including the FFIEC Cybersecurity Assessment Program, which measures and defines our inherent risks and the maturity of our preparedness. This process is overseen by our IT Committee and presented to the Board of Directors.

companyName: River Financial Corp

ticker: RVRF


text: Our cybersecurity risk management program includes: • a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security department, including our CISO and experienced information systems security professionals and information security managers, divided into three teams: (1) security operations, which is responsible for responding to abuse on our platform, digital forensics and incident response, and threat intelligence; (2) security engineering, which is responsible for security data analysis and observability on our infrastructure and product offerings; and (3) trust and governance, which is responsible for privacy and security regulatory compliance and risk management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our Board of Directors (Board); • deployment of technical safeguards that are designed to protect our platform, customers, employees and systems from cybersecurity threats. We maintain cybersecurity insurance that provides coverage for cyber breaches, cyber-crime, and related matters; • the imposition of contractual obligations related to cybersecurity on our third-party vendors. In addition, we assess the security profile of those vendors that store, process or have access to sensitive data through questionnaires and data flow risk assessments; • securing data going to third-party vendors and, depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including through the use of monitoring tools, threat intelligence tools, and data protection tools. We actively monitor, manage and configure our systems to protect our data against any vulnerabilities we find; • continuous monitoring of our infrastructure network for vulnerabilities and threats through our security observability platform; • a system to proactively identify risks that may threaten customer information and utilize both internal and external resources to perform a variety of vulnerability and penetration testing on the platforms, systems and applications used to provide our products and services; • engagement of third party experts to assist in assessing, managing and reviewing various risks from cybersecurity threats and incidents, including to perform independent audits our data centers, to conduct adversary simulations and to perform network penetration tests periodically; • mandatory periodic cybersecurity awareness training for all of our employees and consultants, covering key threats and measures to take to protect their own data and the data of the company in addition to role-specific training for security personnel; and • a robust privacy practice governing information we collect from customers and how we use, share and store such customer data and implementation of measures to collect personal data only to the extent necessary to service our customers and to protect customer content data through limited access.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. Prior to December 31, 2023, the Audit Committee received regular reports from AIR on our cybersecurity risks. Since December 31, 2023, the Audit Committee has begun receiving and will continue to receive regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Aimco OP L.P.


text: We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer ("CISO") and Chief Compliance Officer, who report to our Chief Legal Officer.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: The Company's Chief Information Officer and its Vice President of Information Security are members of the Company's management that are principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Information Officer serves as Chair of the Company's Cyber Security Committee and works in coordination with the other members of the Cyber Security Committee, which includes our Vice President of Information Security, EVP, Operations, EVP, Chief Financial Officer, Chief Compliance Officer, and VP, Legal – Intellectual Property and Privacy, who also serves as the Company's Privacy Compliance Officer and Data Protection Officer.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Our sole director and officer is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation.

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: We consider cybersecurity as part of our broader consideration of business strategy and risk management. Our board of directors has delegated to the Audit Committee the responsibility of overseeing our risk management program, including risk assessment, risk management, and risk mitigation policies and programs. A key part of this responsibility is overseeing the cybersecurity program. The Audit Committee receives quarterly updates from our CIO with respect to the cybersecurity program, including current threat levels and ongoing program enhancements. The Audit Committee oversees our compliance with the industry-standard cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, penetration testing, the CSIRP, business continuity plans, and threat assessments. The Audit Committee also periodically evaluates our cyber strategy to ensure its effectiveness, including benchmarking against our peers.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: While the Company does not believe that any risks from cybersecurity threats (as defined in Item 106 of Regulation S-K), including as a result of any previous cybersecurity incidents, have to-date materially affected the Company, including its business strategy, results of operations or financial condition, the occurrence of cybersecurity incidents, or a deficiency in cybersecurity, could negatively impact the Company's business by causing a disruption to its operations, a compromise or corruption of confidential information, or damage to the Company's employee and business relationships, any of which could have adverse effects on the Company's results of operations, financial condition and cash flow and harm its brand. The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by others, including by the Company's service providers. See "Risk Factors – The occurrence of cyber incidents, or a deficiency in cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of confidential information, or damage to our employee and business relationships, any of which could subject us to loss and harm our brand" for further information.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank improve and test its cybersecurity readiness. The Bank engages third-party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: Our cybersecurity risk management processes are integrated into our overall enterprise risk management system. Our Board understands the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to provide effective oversight of risks associated with cybersecurity.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Management Oversight Our COO, CISO, Chief Global Privacy Officer ("CPO"), our General Counsel ("GC") and various members of the Incident Response Team play an important role in managing the Company's cybersecurity-related risks and maintaining an ongoing dialogue with the Board, the Governance Committee and the Company's Disclosure Committee. Potential cybersecurity incidents come to the attention of the Incident Response Team, which then responds to such incidents in accordance with our incident response plan. When appropriate, cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident. The members of the Disclosure Committee, which is responsible for addressing the Company's public disclosures and internal controls, include the GC, CISO, CPO, our Chief Operating Officer, certain members of the Incident Response Team, and other members of senior management from legal, finance, risk management, internal audit and communications.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: We have established an internal cross-group committee (Cyber Security Management Committee ("CSMC") designating the area of cyber security risk management as "business critical". The CSMC, under the guidance of the Board of Directors, is responsible for the risk management strategy and governance of this critical business area. Under the CSMC, a formal monthly reporting on cyber security related matters has been implemented and this is provided to the Management of Company for ongoing review. The monthly reporting covers: (i) the outcome of random testing designed to identify threats, access violations and risks;

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at each regular board meeting as well as at the ONES and Audit Committee meetings throughout the year.

companyName: XCEL ENERGY INC

ticker: XEL


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: KILROY REALTY CORP

ticker: KRC


text: We face a number of cybersecurity risks in connection with our business. Although we maintain and enforce our Cybersecurity Program, we may not detect or prevent all attempts to compromise our systems or otherwise cause breaches or disruptions, which could result in material impacts to our operations or financial condition. As of the date of the filing of this Annual Report on Form 10-K, we are not aware of any material impact to our results of operations or financial conditions resulting from cyberattacks or other information security breaches. For more information about the cybersecurity risks we face, see the risk factor entitled "We could be the target of a significant cyber-attack, threat or incident that impairs internal systems, results in adverse consequences to information our system process, store or transmit or causes reputation or monetary damages as a consequence" in Item 1A- Risk Factors.

companyName: Virtu Financial, Inc.

ticker: VIRT


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors. Our CISO has received certifications relating to information security, security leadership, and forensics from the Global Information Assurance organization.

companyName: CONTINENTAL RESOURCES, INC


text: Our Board of Directors holds oversight responsibility over AGBA's risk management and strategy, including material risks related to cybersecurity threats.

companyName: Triller Group Inc.

ticker: ILLR


text: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include: • Board of Directors: The Board has ultimate oversight responsibility for cybersecurity. The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. • Audit Committee: The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans. • Chief Information Security Officer (CISO): Casey O'Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program. Casey has had a distinguished career holding IT leadership positions since 2015 and has been employed in the cybersecurity field since 2001. • Information Security Governance: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy. • Cybersecurity Risk Management Team: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks. • Incident Response Team: The Incident Response Team is responsible for responding to and recovering from cyberattacks.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Cantor conducts periodic internal and external vulnerability audits and assessments and penetration testing and provides periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. Cantor participates in industry-specific cybersecurity roundtables and professional groups to ensure it remains abreast of industry-wide cybersecurity developments and best practices and thereby enhances our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for its business, Cantor conducts various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with Cantor's business requirements and risk tolerances.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: We utilize the Center for Internet Security ("CIS") Critical Security Controls as a framework for managing our cybersecurity program. The CIS framework outlines 18 critical control areas relating to organizational security and provides effective methodologies, guidelines, and industry standard best practices to develop and manage a comprehensive cybersecurity program. Additionally, we align our controls to various international security certifications and standards and have adopted best practices from industry leading frameworks. Our cybersecurity program includes policies and procedures relating to encryption, data loss prevention technology, authentication technology, access control, anti-malware software, third-party risk monitoring, insider risk management and identity management. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also regularly obtain system and organization control ("SOC") reports from our service providers ("SOC 2"). Members of our corporate information security organization receive information exchanges from their professional networks and attend training, webinars, and conferences to stay up to date on both trends and system-specific updates. In addition, all Cohu employees are required to complete regular security awareness training including testing, each of which are designed to promote a company-wide culture of cybersecurity risk awareness and management.

companyName: COHU INC

ticker: COHU


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Board of directors' oversight and management's role Our board of directors has primary oversight of risks from cybersecurity threats. The board of directors delegates oversight of our enterprise risk management process with respect to material risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for reviewing and discussing with management the Company's risk from cybersecurity threats and the security of the Company's data and information technology systems, reviewing management's cybersecurity strategy, as well as the implementation of cybersecurity policies, procedures and strategies. Additionally, on a periodic basis, management reviews results from assessments of key risks with the Audit Committee and the steps taken to mitigate new risks which have been identified.

companyName: Vital Energy, Inc.

ticker: VTLE


text: The Company's Critical Threat Committee is responsible for evaluating the materiality of a cybersecurity incident based on criteria that has been reviewed with the Board of Directors, and for determining whether there are disclosure obligations under applicable securities laws. In the event that the Critical Threat Committee determines that a critical cybersecurity incident (or incidents, if aggregated together) is deemed to be material, the Critical Threat Committee will brief the Board of Directors and oversee the disclosure process. For all critical cybersecurity incidents that are not deemed to be material, the Critical Threat Committee will notify the Company's Chairman and Chief Executive Officer to determine whether the Board of Directors will be notified of the critical incident during the next regularly-scheduled cybersecurity update to the Audit Committee, or sooner as circumstances warrant.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also are informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Information Officer.

companyName: U.S. SILICA HOLDINGS, INC.


text: Mendes is associated with multiple digital enablement solutions over the past fifteen years, including the world's first integration by a global processor of the Mastercard Mobile Over-the-Air Provisioning Service (MOTAPS) in conjunction with MasterCard Worldwide. Additionally, Mr. Mendes oversaw the development of the Token Processing Appliance (TPA) solution that enables Host Card Emulation (HCE) and Tokenization deployment to simplify on-premises implementation of Cloud-based payments.

companyName: Spectaire Holdings Inc.


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. The corporate information security organization manages and continually enhances a robust enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our computer incident response team (CIRT), which is responsible for the protection, detection and response capabilities used in the defense of Lockheed Martin's data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We face risks associated with security breaches through cyber-attacks, cyber intrusions, as well as other significant disruptions of our information systems."

companyName: Plymouth Industrial REIT, Inc.


text: Incident reports and issues identified from any cybersecurity events; and standards. In addition to our regularly scheduled Board meetings, the ISO regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: As of the date of this report, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations. However, there can be no assurance that the Company will not be materially affected by such risks. See Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks for a discussion of cybersecurity risks.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Risks Related to Our Business—We could be negatively impacted by cybersecurity attacks."

companyName: CNL Strategic Capital, LLC


text: We have established a cybersecurity incident response plan that includes procedures for responding to relevant cybersecurity incidents. These protocols include incident response plans and escalation procedures to minimize the impact of potential breaches.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: The risk assessment process identifies areas that are required to be protected and determine if adequate controls are used to safeguard the Company against threats and vulnerabilities. Adjustments required to adhere to regulatory changes are a regular function of the assessment process as well as changes to technologies, processes, and other factors. From the analyses, any additional controls are identified, prioritized and implemented.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks remains elevated. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not to our knowledge materially affected the Company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Technology and Security" in Item 1A. Risk Factors.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure. " In Item 1A- Risk Factors.

companyName: SouthState Bank Corp

ticker: SSB


text: State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments where our customers are located.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: The Incident Response Plan includes procedures for timely escalation and reporting of potentially significant cybersecurity incidents to the Company's Chief Operating Officer, Chief Financial Officer, Chief Risk Officer, our Board Risk Committee, law enforcement, government agencies and impacted parties, as needed.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: In addition, our board of directors, as a whole and through the Bank's Corporate Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives reports, at least quarterly, from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, our CIO and our CISO regularly brief the Audit Committee on cybersecurity matters. In its oversight role, the Audit Committee receives reports on cybersecurity, including internal and external cybersecurity audits, on at least a quarterly basis. We have procedures led by our CISO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Audit Committee would be informed of an incident by our executive team.

companyName: Qorvo, Inc.

ticker: QRVO


text: We conduct periodic risk assessments to identify potential cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. The frequency of these risk assessments is based on the potential risk and criticality to our business systems. The risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential impact and damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: AppLovin Corp

ticker: APP


text: Information security and protection of our data is important to Wesco, our customers and suppliers. We take a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Overseeing Third-Party Risk. Because we are aware of the risks associated with engaging third-party service providers, the Company has implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our Chief Operations Officer.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Cybersecurity risk is managed through effective inter-department cooperation towards assessing and remediating risks ranging across corporate IT, software development, software quality process, production network architecture and deployment, and data security/privacy.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our products involve the collection, storage and processing of customer data (including, in some cases, personal data), and may provide business critical software and analytics necessary for our customers' operations. Guidewire develops, implements, and maintains cybersecurity measures designed to safeguard our products and protect the confidentiality, integrity, and availability of our customer data and our confidential information.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.

companyName: SideChannel, Inc.

ticker: SDCH